Fortinet patches critical unauthenticated code-execution flaws in management products
Original title: Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login
CVE-2026-126170 scores 9.8 on the JSON-RPC API; FGFM and OFTP flaws can also run code before login.
Fortinet disclosed critical flaws in FortiManager, FortiAnalyzer, and FortiOS covering management APIs, device services, routing, and some high-availability setups. When the JSON API is enabled, CVE-2026-126170 can let an unauthenticated attacker run code or commands. Separate FGFM and OFTP issues can lead to code execution before authentication, while other flaws cover SSRF, BGP, OSPF, VDOM access, and specific FortiOS command execution. Fortinet says the FGFM issue was not known to be exploited at publication and shipped fixes before the detailed advisories.
Unconfirmed: Fortinet states no known exploitation only for CVE-2026-126261; status of the other flaws is not stated.
- CVE-2026-126261 affects FortiManager 8.0.0, 7.6.0–7.6.7, 7.4.0–7.4.5, and 7.2.0–7.2.8.
- Fixed FGFM releases are 8.0.1, 7.6.8, 7.4.6, and 7.2.9.
- FGFM uses TCP port 541 and OFTP uses TCP port 514.
- For CVE-2026-126170, Fortinet listed 8.0.3 as forthcoming.
- Unused JSON API access can be limited with set rpc-permit none.
Impact: Unauthenticated code or command execution on exposed management services
| Product | Affected | Fixed in |
|---|---|---|
| Fortinet FortiManager | 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, 7.2.0 through 7.2.8 for CVE-2026-126261 | 8.0.1, 7.6.8, 7.4.6, 7.2.9 |
| Fortinet FortiAnalyzer | — | — |
| Fortinet FortiOS | — | — |
- 1.Upgrade affected FortiManager branches to 8.0.1, 7.6.8, 7.4.6, or 7.2.9.
- 2.Disable unused JSON API access with set rpc-permit none while verifying advisories.
- 3.Prioritize internet-exposed FGFM and OFTP services on TCP 541 and 514.
- CVEs
- CVE-2026-126170CVE-2026-126261CVE-2026-126262CVE-2026-126260CVE-2026-126254CVE-2026-126253CVE-2026-126229CVE-2026-126259
- Vendors
- Fortinet
- Products
- FortiManagerFortiAnalyzerFortiOS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-126170 | — | — | — | ||
| CVE-2026-126229 | — | — | — | ||
| CVE-2026-126253 | — | — | — | ||
| CVE-2026-126254 | — | — | — | ||
| CVE-2026-126259 | — | — | — | ||
| CVE-2026-126260 | — | — | — | ||
| CVE-2026-126261 | Unauthenticated command execution in FortiManager via FGFM | 9.8 | — | ||
| CVE-2026-126262 | — | — | — |
From the original article
3 min read at cybersecuritynews.com
Fortinet has disclosed critical security flaws affecting FortiManager, FortiAnalyzer, and FortiOS, including weaknesses that could let attackers execute code without logging in. Published on November 10, 2026, the disclosures cover management APIs, device communication services, routing, and specific high availability setups.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.