Fortinet patches eight critical flaws across security products

Fortinet has published eight critical advisories on 10 November 2026, addressing a pack of high-severity flaws across FortiOS, FortiManager, FortiAnalyzer and FortiSASE. The vulnerabilities carry CVSSv3 scores from 9.0 to 9.8, with the standout CVE-2026-126170 described as an unauthenticated remote code execution in FortiManager and FortiAnalyzer when the JSON API is enabled. Fortinet notes that six of the eight flaws require no login to exploit, and several target FortiManager and FortiAnalyzer services.

While Fortinet reports no confirmed attacks to date, some advisories show proof-of-concept or functional exploit indications, and one entry is marked with a HA patch as “upcoming” (FG-VD-61445.0day). Fortinet’s disclosures emphasise that FortiManager and FortiAnalyzer control and log large fleets of FortiGate devices, meaning a compromise could ripple across a network.

The eight CVEs highlighted include CVE-2026-126170 (RCE in multiple products), CVE-2026-126262 (SQL injection via crafted OFTP packets), CVE-2026-126261 (improper authorisation in FGFM), CVE-2026-126260 (pre-auth SSRF over OFTP), CVE-2026-126229 (admin authentication bypass affecting VDOMs), CVE-2026-126254 (BGP numeric truncation in FortiOS), CVE-2026-126253 (OSPF authentication bypass), and CVE-2026-126259 (missing authentication in HA).

FortiOS versions affected range from 7.2.0–7.2.13, 7.4.0–7.4.12, 7.6.0–7.6.7, and 8.0.0–8.0.1; FortiManager/FortiAnalyzer branches include 7.2, 7.4, 7.6 and 8.0, with Cloud variants also implicated. Patches advise upgrading to FortiOS 7.2.14, 7.4.13, 7.6.8 or 8.0.2, and FortiManager/FortiAnalyzer to 7.2.13, 7.4.12, 7.6.8 or 8.0.2, noting some fixes remain forthcoming and that disabling the JSON API (set rpc-permit none) is a recommended interim step. Fortinet also urges applying the FortiGuard virtual patch for the HA flaw and keeping OFTP and FGFM ports off the internet.