Fortinet patches critical unauthenticated code-execution flaws in management products
CVE-2026-126261 hits listed FortiManager branches; Fortinet reports no known exploitation, with fixes in 7.2.9, 7.4.6, 7.6.8 and 8.0.1.
Stories per day · 30 days
2 RSS
Relatedfortinet39fortianalyzer29fortios7command-injection6fortigate5peerstitch5unc58205cwe-784fortimail4fortisase4path-traversal4privilege-escalation4sql-injection4authorization-bypass3cve-2024-475753cve-2025-616243json-rpc3remote-code-execution3
19 stories, newest first · one card per story
Stories tagged #fortimanager
Fortinet patches critical unauthenticated code-execution flaws in management products
CVE-2026-126170 scores 9.8 on the JSON-RPC API; FGFM and OFTP flaws can also run code before login.
11
FortiManager and FortiAnalyzer API flaw allows file write and delete
A read-only authenticated user can alter filesystem files through crafted HTTP or HTTPS requests; CVSS is 7.3.
FortiManager dmserver flaw lets admins access other VDOMs
The CVSS 9.1 CWE-639 issue also covers FortiAnalyzer and both cloud products; no fix or exploitation is stated.
FortiManager template injection can grant super admin on FortiGates
Fortinet rates the command-injection path CVSS 8.4; the notice does not name versions, fixes or active attacks.
Unauthenticated FortiManager FGFM flaw allows code execution
An attacker who can reach the FGFM port may run code before the registration password is verified; CVSS 9.0.
Fortinet patches critical FortiOS flaws, details held to November 10
Fixes cover FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator; Fortinet says public diffs will show attackers where to look.
Canadian centre flags Fortinet flaws in six product lines (AV26-1081)
Fixed builds are listed for current branches, while FortiMail 7.2 must move to branch 7.4 or above.
Fortinet schedules critical fixes for FortiOS, FortiManager, and FortiAnalyzer
Minimum fixed builds are set for October 22, while PSIRT advisories and CVE details are due November 10.
Fortinet urges urgent patches for FortiOS, FortiManager and FortiAnalyzer
October 22 updates precede November 10 PSIRT advisories; Fortinet reports no active exploitation and lists no CVE IDs.
UNC5820 used Fortinet zero-days to plant PeerStitch at a telecom
CISA added CVE-2025-61624 to KEV; the memory-only implant rides legitimate FortiGate process traffic.
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
Unit 42 says PEERSTITCH, planted through FortiManager flaws, exposed material for more than 500 firewalls.
9
New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory
Unit 42 details PEERSTITCH, a memory-resident implant used against FortiGate firewalls at a telecom MSP.
9
Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Attackers exploited Fortinet flaws at a telecom MSP and deployed the stealthy PEERSTITCH implant on FortiGate firewalls.
14
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Unit 42 says UNC5820 stole data on 500-plus FortiGates and deployed memory-resident PEERSTITCH malware.
4
Fortinet security advisory (AV26-1037)
Canada's Cyber Centre urges patches for file-write and SQL-injection flaws across several Fortinet products.
Multiple Arbitrary File Read/Write via SQL Injection
Fortinet says SQL injection in FortiAnalyzer and FortiManager lets low-privileged users run arbitrary commands.
Workflow session email approval process bypass
Fortinet disclosed an improper access control flaw (CVSS 4.7) in FortiManager allowing administrators to bypass workflow session email approval via crafted HTTP requests.
FGFM Authentication Weakening via CLI Configuration
FortiManager FGFM flaw (CVSS 7.3) lets an attacker with a valid certificate impersonate any managed FortiGate under a specific CLI option.