Fortinet patches critical unauthenticated code-execution flaws in management products
CVE-2026-126261 hits listed FortiManager branches; Fortinet reports no known exploitation, with fixes in 7.2.9, 7.4.6, 7.6.8 and 8.0.1.
Stories per day · 30 days
1 RSS
Relatedfortimanager29fortinet29fortios6command-injection5fortimail4path-traversal4sql-injection4cwe-783json-rpc3authentication-bypass2code-injection2cwe-892fortiauthenticator2fortisase2heap-overflow2privilege-escalation2remote-code-execution2advisory1
12 stories, newest first · one card per story
Stories tagged #fortianalyzer
Fortinet patches critical unauthenticated code-execution flaws in management products
CVE-2026-126170 scores 9.8 on the JSON-RPC API; FGFM and OFTP flaws can also run code before login.
11
FortiManager and FortiAnalyzer API flaw allows file write and delete
A read-only authenticated user can alter filesystem files through crafted HTTP or HTTPS requests; CVSS is 7.3.
FortiManager dmserver flaw lets admins access other VDOMs
The CVSS 9.1 CWE-639 issue also covers FortiAnalyzer and both cloud products; no fix or exploitation is stated.
SQL injection in FortiAnalyzer and FortiManager allows authenticated code execution
The CVSS 8.8 flaw also covers both Cloud products and is triggered by crafted JSON-RPC requests.
Fortinet patches critical FortiOS flaws, details held to November 10
Fixes cover FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator; Fortinet says public diffs will show attackers where to look.
Canadian centre flags Fortinet flaws in six product lines (AV26-1081)
Fixed builds are listed for current branches, while FortiMail 7.2 must move to branch 7.4 or above.
Fortinet schedules critical fixes for FortiOS, FortiManager, and FortiAnalyzer
Minimum fixed builds are set for October 22, while PSIRT advisories and CVE details are due November 10.
Fortinet urges urgent patches for FortiOS, FortiManager and FortiAnalyzer
October 22 updates precede November 10 PSIRT advisories; Fortinet reports no active exploitation and lists no CVE IDs.
Fortinet security advisory (AV26-1037)
Canada's Cyber Centre urges patches for file-write and SQL-injection flaws across several Fortinet products.
Multiple Arbitrary File Read/Write via SQL Injection
Fortinet says SQL injection in FortiAnalyzer and FortiManager lets low-privileged users run arbitrary commands.
Uncontrolled Resource Consumption in SNMP
Uninitialized variable flaw (CVSS 5.9) in FortiAnalyzer's SNMP daemon lets remote authenticated attackers cause denial of service via SNMP GETBULK requests.