Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Fortinet revises authorization-bypass advisories without fixes

1 source · 7 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Fortinet revised authorization-bypass notices on November 10, 2026, listing no versions, patches, or exploitation.

On November 10, 2026, Fortinet PSIRT revised several authorization advisories for FortiMail, FortiManager, FortiAnalyzer, related cloud products, and FortiSase-Sovereign. Most are CWE-639 authorization bypasses through a user-controlled key; one cites incorrect authorization, improper privilege management, and authentication bypass by spoofing. Impacts include unauthenticated IBE account takeover and quarantine-message release or deletion, plus authenticated cross-tenant mailbox access, other-VDOM access, out-of-scope command execution, and privilege escalation to root through crafted HTTP or GUI requests. Scores range from CVSS 7.5 to 9.1. None of the notices name affected or fixed versions or an exploitation status.

Key facts
  • FG-IR-26-208: unauthenticated FortiMail IBE account takeover, CVSS 9.1.
  • FG-IR-26-211: unauthenticated quarantine release or deletion, CVSS 7.5.
  • FG-IR-26-204: authenticated cross-tenant mailbox access and root directory deletion, CVSS 8.1.
  • FG-IR-26-244: authenticated administrator reaches other VDOMs, CVSS 9.1.
  • FG-IR-26-235: authenticated FortiManager administrator elevates to root, CVSS 8.2.
  • FG-IR-26-228 and a separate GUI notice score CVSS 8.7; FortiAnalyzer-BigData is also listed.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 10, 2026Fortinet revises the authorization advisories. · Fortinet PSIRT

What each outlet adds

beyond the shared facts
  • Fortinet PSIRTLists distinct advisory IDs, scores, products, and attacker requirements.
Vendors
Fortinet
Products
FortiMailFortiManagerFortiAnalyzerFortiManager CloudFortiAnalyzer CloudFortiSase-SovereignFortiAnalyzer-BigData

Coverage

oldest first · one row per article · UTC
  1. · 20h ago Fortinet PSIRTFirst report

    FortiManager dmserver flaw lets admins access other VDOMs

    The CVSS 9.1 CWE-639 issue also covers FortiAnalyzer and both cloud products; no fix or exploitation is stated.

  2. · 20h ago Fortinet PSIRT

    FortiMail flaw lets unauthenticated attackers take over IBE accounts

    Fortinet rates the IBE account-takeover issue CVSS 9.1; the notice gives no versions, fix, or exploitation status.

  3. · 20h ago Fortinet PSIRT

    Unauthenticated FortiMail flaw can alter quarantined mail

    Fortinet scores the quarantine release-or-delete issue CVSS 7.5 and does not name versions or a patch.

  4. · 20h ago Fortinet PSIRT

    FortiManager flaw lets admin users gain root over HTTP

    The CVSS 8.2 issue requires an authenticated administrator; Fortinet does not list versions or a fix.

  5. · 20h ago Fortinet PSIRT

    FortiManager and FortiAnalyzer flaws let admins escalate privileges

    An authenticated administrator can bypass authorization or impersonate internal services through crafted GUI requests.

  6. · 20h ago Fortinet PSIRT

    FortiManager GUI flaw lets authenticated users run out-of-scope commands

    Fortinet rates the CWE-639 GUI flaw CVSS 8.7; the advisory gives no versions, fix, or exploitation status.

  7. · 20h ago Fortinet PSIRT

    Authenticated FortiMail flaw can delete directories as root

    The CVSS 8.1 bug also exposes or deletes other tenants' calendar and mailbox data; no fix is listed.