Fortinet has disclosed critical security flaws across FortiManager, FortiAnalyzer, and FortiOS. The issues include weaknesses that could let attackers execute code without logging in, and the disclosures say exposure depends on enabled features and network access.
FortiManager and FortiAnalyzer exposure
The highest-rated flaw is CVE-2026-126170, tracked as FG-IR-26-219. It has a CVSS score of 9.8 and involves JSON injection in the JSON-RPC API used by FortiManager and FortiAnalyzer. When the JSON API is enabled, crafted requests could allow an unauthenticated attacker to execute code or commands. Systems that use the API for automation need close review.
CVE-2026-126261 is another critical issue, and it affects FortiManager’s FGFM service. Fortinet rates it 9.0 and tracks it as FG-IR-26-275. The authorization weakness allows an attacker who can reach the FGFM port to send crafted packets and potentially execute code. The problem occurs before the registration password is verified, which places the service itself in the attack path.
CVE-2026-126262 is tracked as FG-IR-26-276 and rated 9.3. It affects FortiAnalyzer and FortiManager systems with FortiAnalyzer features enabled, and it exposes them to SQL injection through OFTP. An attacker does not need to log in, and successful exploitation could lead to code execution. Access to the log transfer service is part of the exposure check.
October releases and fixed versions
These disclosures follow the October security releases previously covered in Cyber Security News’ Fortinet patch warning. Fortinet released updates before publishing the detailed advisories, which gave customers time to upgrade. Administrators should not assume that installing one October build resolves every November finding, because fixes differ by vulnerability and software branch.
Fortinet’s FGFM advisory lists FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 as affected by CVE-2026-126261. The fixed releases are 8.0.1, 7.6.8, 7.4.6, and 7.2.9, respectively. Fortinet says the issue was not known to have been exploited when published.
CVE-2026-126260 is a separate OFTP risk. It is rated 9.0 and tracked as FG-IR-26-274. The pre-authentication server-side request forgery flaw affects FortiAnalyzer and FortiManager with FortiAnalyzer features enabled. Fortinet says it should not be confused with confirmed remote code execution. Its impact is that the server can be made to send requests, while the SQL injection issue follows a different attack path.
Routing and access control flaws
The release also includes CVE-2026-126254, a 9.6-rated numeric truncation flaw in FortiOS BGP handling. It requires traffic from a configured iBGP neighbor. CVE-2026-126253 is rated 9.3 and concerns an OSPF authentication bypass that could permit forged routing advertisements. These are routing risks, not interchangeable examples of management server code execution.
CVE-2026-126229 is rated 9.1 and could let an authenticated administrator access other virtual domains, or VDOMs, outside their permitted scope. CVE-2026-126259 is rated 9.0 and allows command execution with super-admin privileges in specific FortiOS setups involving FGSP with standalone configuration synchronization, or affected autoscale configurations. Fortinet does not describe either issue as affecting every deployment equally.
Why the service ports matter
The disclosures also point to service exposure beyond the browser login page. FGFM uses TCP port 541, and OFTP uses TCP port 514. Administrative login restrictions do not directly protect those services. Earlier FortiManager compromise reporting showed that access to a central management appliance could expose sensitive information tied to hundreds of managed firewalls.
What Fortinet advises
Fortinet’s security release guidance tells customers to prioritize exposed systems, back up configurations, and monitor unauthorized changes. For CVE-2026-126170, the 8.0 branch needs particular attention because 8.0.3 was listed as forthcoming. Disabling unused JSON API access with set rpc-permit none reduces exposure while administrators review the latest advisory and plan the update.
Licensed under CC BY-ND 4.0 International