Fortinet patches critical unauthenticated code-execution flaws in management products
Original title: Critical Fortinet Vulnerabilities Allow Unauthenticated Attackers to Execute Remote Code on FortiManager and FortiAnalyzer
CVE-2026-126261 hits listed FortiManager branches; Fortinet reports no known exploitation, with fixes in 7.2.9, 7.4.6, 7.6.8 and 8.0.1.
Fortinet disclosed critical flaws in FortiManager, FortiAnalyzer and FortiOS on November 10, 2026. CVE-2026-126170, CVSS 9.8, is JSON injection in the JSON-RPC API that can run commands without authentication when that API is enabled. CVE-2026-126261 is an FGFM authorization weakness before the registration password check; Fortinet lists no known exploitation. Separate OFTP, routing, VDOM and FGSP issues are also covered, and fixes differ by branch.
Unconfirmed: No known exploitation is stated only for CVE-2026-126261; exploitation status of the other flaws is not given.
- CVE-2026-126261 affects FortiManager 8.0.0, 7.6.0–7.6.7, 7.4.0–7.4.5 and 7.2.0–7.2.8.
- Fixes for that flaw are 8.0.1, 7.6.8, 7.4.6 and 7.2.9 or later.
- For CVE-2026-126170, version 8.0.3 is forthcoming; rpc-permit none is a temporary mitigation.
- FGFM uses TCP port 541 and OFTP uses TCP port 514.
- FortiOS BGP flaw CVE-2026-126254 requires traffic from a configured iBGP neighbor.
Impact: Unauthenticated code or command execution on exposed management services
| Product | Affected | Fixed in |
|---|---|---|
| Fortinet FortiManager | 8.0.0, 7.6.0–7.6.7, 7.4.0–7.4.5, 7.2.0–7.2.8 for CVE-2026-126261 | 8.0.1, 7.6.8, 7.4.6, 7.2.9 or later |
| Fortinet FortiAnalyzer | — | — |
| Fortinet FortiOS | — | — |
- 1.Upgrade FortiManager to 8.0.1, 7.6.8, 7.4.6, or 7.2.9 or later for CVE-2026-126261.
- 2.Set rpc-permit to none to restrict unused JSON API access while planning upgrades.
- 3.Review reachability of FGFM on TCP 541 and OFTP on TCP 514.
- CVEs
- CVE-2026-126170CVE-2026-126261CVE-2026-126262CVE-2026-126260CVE-2026-126254CVE-2026-126253CVE-2026-126229CVE-2026-126259
- Vendors
- Fortinet
- Products
- FortiManagerFortiAnalyzerFortiOS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-126170 | — | — | — | ||
| CVE-2026-126229 | — | — | — | ||
| CVE-2026-126253 | — | — | — | ||
| CVE-2026-126254 | — | — | — | ||
| CVE-2026-126259 | — | — | — | ||
| CVE-2026-126260 | — | — | — | ||
| CVE-2026-126261 | Unauthenticated command execution in FortiManager via FGFM | 9.8 | — | ||
| CVE-2026-126262 | — | — | — |
From the original article
2 min read at gbhackers.com
Fortinet disclosed critical vulnerabilities in FortiManager, FortiAnalyzer, and FortiOS on November 10, 2026, including flaws that could let attackers execute code without logging in. The disclosures cover management APIs, device communication, routing, and specific high availability configurations. Exposure depends on enabled services, network access, and deployment settings.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.