Critical Fortinet Vulnerabilities Expose FortiManager and FortiAnalyzer to Unauthenticated Remote Code Execution
Fortinet has disclosed multiple critical security vulnerabilities affecting FortiManager, FortiAnalyzer and FortiOS, warning that certain weaknesses could allow remote attackers to execute commands without authentication. The disclosures, published on November 10, 2026, cover management APIs, device communication services and network routing functions.
The vulnerabilities carry severity ratings as high as 9.8 on the Common Vulnerability Scoring System (CVSS), making them an important concern for organizations using Fortinet infrastructure to manage enterprise networks and security operations.
Critical Flaws Affect Management Platforms
The most severe issue is tracked as CVE-2026-126170 and carries a CVSS score of 9.8. Identified as a JSON injection vulnerability in the JSON-RPC API, it affects FortiManager and FortiAnalyzer.
When the JSON API is enabled, specially crafted requests could allow unauthenticated attackers to execute arbitrary code or commands. Organizations using the API for automation and system integrations should review their configurations and ensure that the appropriate security updates are installed.
Another vulnerability, CVE-2026-126261, affects FortiManager's FortiGate-to-FortiManager (FGFM) service. Rated 9.0, the flaw involves an authorization weakness that could allow attackers with network access to the service to send specially crafted packets and potentially execute code.
CVE-2026-126262, rated 9.3, affects FortiAnalyzer and FortiManager deployments with FortiAnalyzer features enabled. The SQL injection vulnerability in the OFTP service could allow unauthenticated attackers to execute code following successful exploitation.
Additional Vulnerabilities Affect Network Security
Fortinet's disclosures also include vulnerabilities affecting FortiOS routing and administrative access controls.
CVE-2026-126254 involves a numeric truncation issue in BGP handling, while CVE-2026-126253 concerns an OSPF authentication bypass that could allow forged routing advertisements.
Other reported issues include CVE-2026-126229, which could enable an authenticated administrator to access virtual domains outside their permitted scope, and CVE-2026-126259, which could allow command execution with super-administrator privileges in specific FortiOS configurations.
These vulnerabilities have different attack requirements and should not be treated as equally exploitable across all Fortinet deployments.
Organizations Urged to Review Security Configurations
Fortinet has released security updates for the affected products, with fixed versions varying according to the vulnerability and software branch.
For example, the published FGFM advisory identifies FortiManager versions 8.0.0, 7.6.0–7.6.7, 7.4.0–7.4.5 and 7.2.0–7.2.8 as affected by CVE-2026-126261. The corresponding fixed releases include versions 8.0.1, 7.6.8, 7.4.6 and 7.2.9.
Security teams should consult the individual Fortinet advisories before upgrading, as installing one security update does not necessarily address every vulnerability in the latest disclosure.
Recommended precautions include restricting access to management services, reviewing exposed network ports, disabling unused API access, backing up configurations and monitoring systems for unauthorized changes.
Why the Vulnerabilities Matter
FortiManager and FortiAnalyzer are important components of enterprise network management and security monitoring. A successful compromise could create risks beyond a single device, potentially affecting the wider infrastructure managed through these platforms.
The disclosures highlight the importance of timely patch management, secure API configurations and continuous monitoring of network management systems.
For organizations operating Fortinet products, reviewing the affected versions and applying the correct security updates should be a priority.
