Newshot Article title: Fortinet Fixes Multiple High-Severity Vulnerabilities, Unauthenticated Remote Code Execution Possible on Management Platform
Body:
Fortinet recently disclosed multiple high-severity security vulnerabilities affecting FortiManager, FortiAnalyzer, and FortiOS, some of which can allow attackers to execute code on target systems without logging in.
This vulnerability advisory was published on November 10, 2026, and involves the management API, device communication services, routing mechanisms, and specific high-availability configuration scenarios. Exploitation conditions differ across the vulnerabilities, and organizations need to assess their actual exposure based on the features they have enabled and their network exposure surface.
Management Plane Vulnerabilities Patched, Unauthenticated Remote Code Execution Possible
The highest severity among them is CVE-2026-126170, with a CVSS score of 9.8 and tracking number FG-IR-26-219. This vulnerability exists in the JSON-RPC API used by FortiManager and FortiAnalyzer and is a JSON injection flaw. As long as the JSON API is enabled, an unauthenticated attacker can send crafted requests to execute code or system commands on the target system. Systems that rely on this API for automated operations need to be prioritized for review.
Another critical vulnerability is CVE-2026-126261, tracking number FG-IR-26-275, with a CVSS score of 9.0, affecting the FGFM service of FortiManager. This vulnerability is an authorization mechanism flaw; as long as an attacker can reach the FGFM service port, they can send crafted packets that may lead to code execution on the target system. The trigger point occurs before the registration password verification process, and the FGFM service itself is directly exposed on the attack path.
The vulnerability numbered CVE-2026-126262 has tracking number FG-IR-26-276 and a CVSS score of 9.3. FortiAnalyzer and FortiManager systems with the FortiAnalyzer feature enabled have an SQL injection risk in their OFTP service. Attackers can exploit this vulnerability without logging in, and successful exploitation can lead to code execution. When reviewing exposure, organizations need to focus on the access controls of the log transmission service.
This advisory comes shortly after the October security update release, and Cyber Security News had previously issued a warning about Fortinet's patch rollout. Fortinet pushed fix updates before publicly releasing detailed advisories, giving customers an upgrade window. However, administrators should note that installing the versions released in October does not fix all vulnerabilities in this November advisory; the fixed versions differ by vulnerability and software branch.
For CVE-2026-126261, Fortinet lists the affected versions in the FGFM service advisory: FortiManager 8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.5, 7.2.0-7.2.8. The corresponding fixed versions are 8.0.1, 7.6.8, 7.4.6, and 7.2.9, respectively. Fortinet stated that at the time of the advisory's publication, no in-the-wild exploitation of this vulnerability had been observed.
The vulnerability numbered CVE-2026-126260 has tracking number FG-IR-26-274 and a CVSS score of 9.0; it is another risk in the OFTP service. This vulnerability is a pre-authorization server-side request forgery flaw affecting FortiAnalyzer and FortiManager systems with the FortiAnalyzer feature enabled. Note that this vulnerability cannot directly lead to remote code execution; attackers can use it to induce the server to initiate outbound requests, which is a completely different attack path from the aforementioned SQL injection vulnerability.
This batch of vulnerabilities also shows that protecting only the browser login page is far from enough. The FGFM service uses TCP port 541, and the OFTP service uses TCP port 514; access control policies targeting management console login cannot directly protect these two services. Previous cases of compromised FortiManager have shown that once attackers gain access to the central management device, they can steal sensitive information associated with hundreds of managed firewalls.
Flaws in Routing and Permission Mechanisms, Security Risks in Specific Scenarios
This update also fixes multiple routing-related vulnerabilities in FortiOS. Among them, CVE-2026-126254 has a CVSS score of 9.6, exists in the BGP protocol processing flow of FortiOS, and is a numeric truncation vulnerability. Attackers need to send traffic from a configured iBGP neighbor position to trigger exploitation of this vulnerability.
CVE-2026-126253 has a CVSS score of 9.3 and is an OSPF authentication bypass vulnerability. Attackers can use this vulnerability to send forged routing advertisements. These vulnerabilities are risks at the routing layer and are different in nature from the aforementioned code execution vulnerabilities in the management server; they should not be conflated.
There are two permission-related vulnerabilities. CVE-2026-126229 has a CVSS score of 9.1; an authenticated administrator can use this vulnerability to access other virtual domains (VDOMs) outside their permitted scope. CVE-2026-126259 has a CVSS score of 9.0; in specific FortiOS deployment scenarios—including FGSP architectures using independent configuration synchronization and affected auto-scaling configurations—attackers can obtain super-admin privileges to execute commands. Neither vulnerability affects all deployment scenarios, and organizations need to assess risk based on their own configurations.
In its security update guidance, Fortinet recommends that customers prioritize fixing internet-exposed systems, back up configurations in advance, and continuously monitor for unauthorized configuration changes. For CVE-2026-126170, users on the 8.0 branch should pay particular attention: at the time of the advisory's publication, the 8.0.3 fixed version was still in preparation. While administrators review the latest advisory and plan upgrades, they can reduce attack risk by running the command set rpc-permit none to disable idle JSON API access.
Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login