SecOraLens
CriticalCVE

Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login

Cyber Security News·Source published ·1 min read

What happened?

Fortinet has disclosed critical security flaws affecting FortiManager, FortiAnalyzer, and FortiOS, including weaknesses that could let attackers execute code without logging in. Published on November 10, 2026, the disclosures cover management APIs, device communication services, routing, and specific high availability setups. Attack requirements differ, making enabled features and network access central to assessing exposure. Critical Fortinet Flaws Patched The highest-rated issue, CVE-2026-126170, carries a CVSS score of 9.8.

Key details

  • Fortinet disclosed critical flaws in FortiManager, FortiAnalyzer, and FortiOS that could allow remote code execution without authentication.
  • CVE-2026-126170 is a JSON injection in the JSON-RPC API of FortiManager and FortiAnalyzer, rated 9.8 CVSS, allowing unauthenticated code execution when the API is enabled.
  • CVE-2026-126261 is an authorization weakness in FortiManager's FGFM service on TCP port 541, rated 9.0, allowing pre-authentication code execution via crafted packets.
  • CVE-2026-126262 is a SQL injection through OFTP on TCP port 514 in FortiAnalyzer and FortiManager with FortiAnalyzer features, rated 9.3, allowing unauthenticated code execution.
  • Fortinet released updates before publishing detailed advisories, but fixes vary by vulnerability and software branch; installing one October build may not resolve all November findings.
  • Administrative login restrictions do not protect FGFM (port 541) or OFTP (port 514) services, which are separate from the browser login page.
  • Additional routing flaws include CVE-2026-126254 (BGP numeric truncation, 9.6) and CVE-2026-126253 (OSPF authentication bypass, 9.3), requiring specific neighbor configurations.

Affected

  • FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 are affected by CVE-2026-126261.
  • FortiAnalyzer and FortiManager with FortiAnalyzer features enabled are affected by CVE-2026-126262 via OFTP on TCP port 514.
  • FortiOS BGP handling is affected by CVE-2026-126254 requiring iBGP neighbor traffic.

Fixes and mitigations

  1. Fixed releases for CVE-2026-126261 are FortiManager 8.0.1, 7.6.8, 7.4.6, and 7.2.9.
  2. Disabling unused JSON API access with 'set rpc-permit none' reduces exposure for CVE-2026-126170 while planning updates.
  3. Fortinet urges customers to prioritize exposed systems, back up configurations, and monitor unauthorized changes.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories