Fortinet revises multiple high-severity advisories; no CVEs named
First merged summary.
On November 10, 2026, Fortinet revised several high-severity PSIRT notices without naming CVEs, versions, fixes, or attacks.
Fortinet PSIRT revised a set of advisories on November 10, 2026, covering injection and authorization flaws in FortiMail, FortiAuthenticator, FortiRecorder, FortiVoice, and collectoragent. The highest scores are 9.8 for unauthenticated FortiMail command injection via HA join-request packets (FG-IR-26-200, CWE-77) and 9.4 for unauthenticated FortiMail SQL injection (CWE-89). Other notices include FortiAuthenticator incorrect authorization at 9.1, plus authenticated command, argument, LDAP, and SQL injection issues scored 7.2 to 8.8. Named identifiers are FG-IR-26-196, FG-IR-26-197, FG-IR-26-198, FG-IR-26-200, FG-IR-26-218, and FG-IR-26-256. None of the notices name a CVE, affected versions, a fix, or known exploitation.
- FG-IR-26-200: FortiMail CWE-77, CVSS 9.8, unauthenticated HA join requests.
- Unauthenticated FortiMail SQL injection scored CVSS 9.4 and classified CWE-89.
- FortiAuthenticator incorrect authorization, CWE-863, scored CVSS 9.1.
- FG-IR-26-218: FortiMail CWE-88, CVSS 7.6, needs domain or system admin.
- FG-IR-26-196 affects FortiMail, FortiRecorder and FortiVoice at CVSS 8.8.
- No CVE, version range, patch, or exploitation status appears in any notice.
Timeline
dated events in the reporting · oldest first- Nov 10, 2026Fortinet revises multiple high-severity PSIRT product advisories. · Fortinet PSIRT
What each outlet adds
beyond the shared facts- Fortinet PSIRTOnly source for scores, CWE classes, FG-IR identifiers, and access requirements.
Coverage
oldest first · one row per article · UTC- · 20h ago
Fortinet PSIRTFirst report
FortiAuthenticator SQL injection scores CVSS 8.8
An authenticated attacker can run unauthorized SQL commands on the underlying database.
- · 20h ago
Unauthenticated FortiMail SQL injection can execute code or commands
Fortinet rates the FortiMail flaw CVSS 9.4 and says crafted requests are enough, with no login required.
- · 20h ago
FortiMail and FortiRecorder OS command injection rated CVSS 7.2
A privileged authenticated attacker can run code or commands through a crafted archive account configuration.
- · 20h ago
FortiMail argument injection lets privileged admins run root commands
Domain or system admins can also delete users on a paired FortiAuthenticator and read or write files as root.
- · 20h ago
collectoragent SQL injection allows authenticated command execution
Fortinet scores the collectoragent flaw CVSS 8.3 and says it is reachable through HTTP requests.
- · 20h ago
FortiAuthenticator flaw lets authenticated attackers escalate privileges
Fortinet scores the improper privilege management issue CVSS 7.2; the advisory was revised on November 10.
- · 20h ago
Unauthenticated FortiMail command injection rated CVSS 9.8
Crafted HA join-request packets can run unauthorized commands; no CVE or versions are named.
- · 20h ago
FortiAuthenticator LDAP injection can bypass authentication
Exploitation needs a malicious or compromised upstream IdP, or user control of the NameID or username attribute.
- · 20h ago
FortiMail OS command injection lets an admin run code as root
The attacker must already be an administrator with system-time read-write access; CVSSv3 is 7.2.
- · 20h ago
FortiMail, FortiRecorder and FortiVoice OS command injection scores 8.8
An authenticated attacker can run unauthorized code or commands through crafted HTTP requests.
- · 20h ago
FortiMail OS command injection lets authenticated admins run code as root
FG-IR-26-210 is scored 7.2 and is triggered by specially crafted HTTP requests.
- · 20h ago
FortiAuthenticator authorization flaw may bypass authentication
Fortinet scores the CWE-863 issue 9.1; the revised notice does not name versions, a fix, or exploitation.