Fortinet November 2026 Critical Vulnerabilities Explained: 17 Critical Flaws, FortiManager RCE and What to Patch First
Image: a FortiGate firewall appliance. FortiOS, the software that runs on FortiGate, is among the products patched in Fortinet's November 2026 release. Image: Premeditated, via Wikimedia Commons, CC BY-SA 4.0.
TL;DR: Fortinet November 2026 critical vulnerabilities explained: Fortinet published 89 security advisories on 10 November 2026 covering nearly 100 flaws, about 17 of them critical, including two CVSS 9.8 remote code execution bugs that need no login. None is confirmed exploited yet — but the fixes have been available since 21 October, so check your version and patch now.
Key Highlights
- Fortinet published 89 security advisories on 10 November 2026, covering nearly 100 vulnerabilities across FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator, FortiSASE and FortiClient — about 17 of them rated Critical.
- The two worst flaws both score CVSS 9.8 and need no login: CVE-2026-126170, an unauthenticated remote code execution bug in the FortiManager and FortiAnalyzer JSON-RPC API, and CVE-2026-126147, an unauthenticated path-traversal flaw in FortiMail that also leads to code execution.
- Fortinet shipped the fixes on 21–22 October but only published the technical details on 10 November — a deliberate "patch first, explain later" release, because AI tools now let attackers reverse-engineer patches within hours or days.
- Several of the flaws were found with the help of frontier AI models, including Anthropic's Claude Mythos, which Fortinet credits in the advisories for the two 9.8 flaws.
- Fortinet reports none of the new flaws is being exploited in the wild, and none appears in CISA's Known Exploited Vulnerabilities catalog — but with full details now public, the window for unpatched systems is closing fast.
What happened? Fortinet November 2026 critical vulnerabilities explained
Fortinet's November 2026 security release is one of the largest the company has ever published. On Tuesday 10 November 2026, its Product Security Incident Response Team (PSIRT) published 89 new advisories addressing nearly 100 vulnerabilities, according to SecurityWeek. Approximately 17 of the flaws are critical-severity issues, and several of them could be exploited for arbitrary code execution. FortiMail received the largest batch of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer, and new FortiSASE and FortiClient updates also resolve critical issues.
The unusual part is the timing. The fixes themselves are not new: Fortinet released updated builds of FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator on 21–22 October, and Australia's cyber security centre issued a critical "act now" alert on 23 October urging organisations to install them. What Fortinet withheld until 10 November was the detail — the CVE numbers, the CVSS scores and the technical descriptions. The company said this approach "gives customers time to prioritize upgrades before additional technical details become public, which matters even more as AI shortens the time between disclosure and exploitation". In other words, Fortinet bet that three weeks of quiet patching would protect more systems than three weeks of public detail.
That bet is now over. The details are public, which means attackers can now read exactly which code paths are broken and build exploits from the patches. Fortinet makes no mention of any of the new flaws being exploited in the wild, and none of them appears in CISA's Known Exploited Vulnerabilities catalog — but the catalog already lists 32 older Fortinet flaws, a reminder that Fortinet's management products are a proven target. Security researchers quoted in the coverage expect the new flaws to be reverse-engineered quickly, so the practical message is simple: if you have not installed the October builds yet, the grace period has ended.
The critical flaws that matter most
Not every flaw in the batch carries the same risk. The table below lists the highest-rated ones, in the order a network team should triage them. Seven of the flaws in the table need no login at all.
| CVE | Product | CVSS | What it does |
|---|---|---|---|
| CVE-2026-126170 | FortiManager / FortiAnalyzer | 9.8 | Unauthenticated remote code execution via the JSON-RPC API, but only when the API is enabled (it is disabled by default). |
| CVE-2026-126147 | FortiMail | 9.8 | Unauthenticated path traversal in the API lets an attacker execute code or commands with crafted requests. |
| CVE-2026-126254 | FortiOS | 9.6 | Numeric truncation flaw in BGP handling; needs traffic from a configured iBGP neighbour, so it is not internet-reachable by default. |
| CVE-2026-126262 | FortiAnalyzer / FortiManager | 9.3 | Unauthenticated SQL injection through the OFTP log-transfer service (TCP/514) can lead to code execution. |
| CVE-2026-126253 | FortiOS / FortiSASE | 9.3 | OSPF authentication bypass lets an adjacent, unauthenticated attacker broadcast forged routing updates. |
| CVE-2026-126229 | FortiManager / FortiAnalyzer | 9.1 | Authorisation bypass in the dmserver component lets an authenticated administrator reach other virtual domains (VDOMs) outside their scope. |
| CVE-2026-126261 | FortiManager | 9.0 | Improper authorisation in the FGFM service (TCP/541) lets an unauthenticated attacker who can reach the port execute commands, before the registration password is even verified. |
| CVE-2026-126260 | FortiAnalyzer / FortiManager | 9.0 | Pre-authentication server-side request forgery (SSRF) through the same OFTP service. |
| CVE-2026-126259 | FortiOS | 9.0 | Missing authentication in high-availability setups lets an attacker run commands with super-admin privileges, but only in FGSP with standalone configuration sync or affected autoscale setups. |
Two more products deserve a mention. FortiAuthenticator, which sits in front of VPN logins and admin multi-factor authentication, has two critical fixes of its own: a hard-coded password flaw (FG-IR-26-271, CVSS 9.0) and an authentication bypass (FG-IR-26-265, CVSS 9.1). And a FortiClient flaw dubbed "Fortinet2Shell" by the researcher who found it — Baldur Security's Kevin Joensen — could let a malicious website execute code on a victim's machine through a CORS misconfiguration when FortiPAM is enabled. The common thread is the management plane: FortiManager and FortiAnalyzer control and log entire fleets of FortiGate firewalls, so taking over one central appliance can expose every firewall it manages.
Illustrative image: a Fortinet FortiToken hardware token. FortiAuthenticator, which manages tokens like this, also received critical fixes in the November 2026 release. Image: Joschi71, via Wikimedia Commons, CC BY-SA 4.0.
The reason this release is being watched so closely is not just the scores. Fortinet found almost all of these flaws itself, using frontier AI models added to its internal security testing about three weeks before the patches shipped. Both 9.8 advisories credit Claude Mythos by name: CVE-2026-126170 was discovered by Fortinet's Loic Pantano "with the use of the frontier AI model: Claude Mythos", and CVE-2026-126147 by Sam Mckee and Theo Leleu, also with Claude Mythos. The same AI assistance that found the flaws can also be used by attackers to reverse-engineer the patches — which is exactly why Fortinet shipped the fixes before publishing the details.
Fixed versions: what to upgrade to
The fixed builds have been available since 21–22 October, so most of this table is a check, not a wait. If your build is lower than the number in your branch, you are in the affected range. FortiSASE was updated automatically by Fortinet, and FortiMail Cloud was remediated on 5 October, so cloud customers on those services do not need to act — but FortiManager Cloud updates may still need a manual step, so verify rather than assume.
| Product | Affected branches | Upgrade to (or above) |
|---|---|---|
| FortiOS (FortiGate) | 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12, 7.2.0–7.2.13 | 8.0.2, 7.6.8, 7.4.13, 7.2.14. FortiOS 7.0 gets no fix — the branch is end-of-support. |
| FortiManager / FortiAnalyzer | 8.0 and 7.6 branches (varies by flaw); 7.4 and 7.2 for some flaws | 8.0.2, 7.6.8, 7.4.12, 7.2.13 — but check each advisory: the CVE-2026-126170 fix for the 8.0 branch is the still-upcoming 8.0.3, and the FGFM fix is 8.0.1 / 7.6.8 / 7.4.6 / 7.2.9. |
| FortiMail | 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, all of 7.2 | 8.0.2, 7.6.7, 7.4.9; FortiMail 7.2 has no in-branch fix — migrate to a fixed release. |
| FortiAuthenticator | See advisories FG-IR-26-271 and FG-IR-26-265 | Check the advisory for your branch — the fixed versions were not in the summaries available at publication time. |
Before upgrading, back up the configuration — Fortinet's own release guidance says so, and it is the one step that turns a bad upgrade into a recoverable one. Then check the version you are actually running: on FortiOS, run get system status from the CLI or check System > Firmware in the GUI; on FortiManager, check System Settings > Dashboard. If the JSON-RPC API is enabled on a FortiManager or FortiAnalyzer profile and you cannot upgrade the 8.0 branch yet, disable it with set rpc-permit none on the admin profile — that is Fortinet's own workaround for CVE-2026-126170. And keep the FGFM port (TCP/541) and the OFTP port (TCP/514) off the internet: login-page restrictions do not protect those services, and two of the critical flaws are reachable through them with no credentials at all. Note also that installing one October build does not fix every November finding, because the fixes vary by vulnerability and software branch — check each advisory against the version you run.
Why Fortinet patched first and explained later
This release is a small experiment in how vulnerability disclosure works now that AI is on both sides. The old pattern was: find the flaw, publish the details, then rush the patch. Fortinet inverted it: its AI-assisted testing programme found the flaws, the company shipped fixed builds on 21–22 October, governments and sector groups warned customers to install them, and only on 10 November did the CVE numbers and technical descriptions appear. Fortinet's reasoning, quoted by SecurityWeek, is that giving customers time to upgrade before details go public "matters even more as AI shortens the time between disclosure and exploitation".
There is evidence the reasoning is sound. The same week, Microsoft's November Patch Tuesday, which fixed an exploited Outlook zero-day the same day, showed what happens when a flaw is already in use before the patch lands. And the Fortinet flaws themselves were found by AI: the advisories credit Claude Mythos in the discovery of the two most severe bugs. The uncomfortable corollary is that attackers have the same class of tool. As one threat researcher put it, the new flaws should be expected to be "rapidly reverse-engineered, reproduced, and exploited". Fortinet's three-week head start only helps the organisations that used it — the rest are now patching in the open, against a public advisory list.
Why it matters for readers in India
Fortinet's gear is everywhere in Indian enterprise networks: FortiGate firewalls guard office perimeters and VPN gateways, FortiManager manages fleets of them for large companies and managed service providers, and FortiMail filters mail for organisations that run their own email security. A flaw in the central management box is therefore not an abstract risk for Indian IT teams — it is a flaw in the box that controls their firewalls. The FGFM and OFTP flaws are especially relevant here, because Indian managed service providers commonly expose management ports to administer customer firewalls remotely; any FGFM or OFTP port reachable from the internet should be treated as exposed until proven otherwise.
There is no India-specific advisory from CERT-In cited in the sources for this release, so this article does not claim one exists — the operative warnings are Fortinet's own advisories and the Australian cyber security centre's critical alert. For home users, the direct risk is lower: the flaws affect enterprise appliances, not home routers. But the indirect risk is real, because the same FortiGate VPNs that let Indian employees work from home are managed by the appliances in this release. If your organisation uses Fortinet, the useful question to ask your IT team is not whether the company has heard of the release — it is whether the FortiManager and FortiGate builds are already on the fixed versions listed above.
Should you patch now?
Verdict: ✅ Patch now — start with internet-facing management boxes. None of the new flaws is confirmed exploited, which is the good news. The bad news is that the details are now public, the fixes have been available for three weeks, and the most dangerous flaws need no login. Upgrade FortiManager, FortiAnalyzer and FortiMail first, then FortiOS, and restrict the FGFM and OFTP ports from the internet while you do it. Waiting for the next patch cycle leaves the worst flaws open after their details have been published.
FAQs
Is Fortinet safe to use after the November 2026 vulnerabilities?
Yes, on the fixed versions. The flaws are in specific builds listed in Fortinet's advisories, and the patched builds close them. The risk is concentrated in unpatched systems, especially FortiManager, FortiAnalyzer and FortiMail boxes reachable from the internet. Check your version against the fixed builds in the table above.
Which Fortinet versions are affected by CVE-2026-126170?
CVE-2026-126170 affects FortiManager and FortiAnalyzer 8.0.0–8.0.2 and 7.6.0–7.6.7, but only when the JSON-RPC API is enabled — it is disabled by default. The 7.4 and 7.2 branches are not affected. The fix is 7.6.8 or above, or the upcoming 8.0.3 for the 8.0 branch; until then, disable the JSON API with set rpc-permit none.
How do I update FortiManager or FortiGate to the fixed version?
Back up the configuration first, then check the running version — get system status on the FortiOS CLI, or System Settings > Dashboard on FortiManager. Download the fixed build for your branch from Fortinet support, install it through the GUI or CLI, and verify the new version after the reboot. FortiSASE and FortiMail Cloud were updated automatically by Fortinet.
Are the November 2026 Fortinet vulnerabilities being exploited?
No. Fortinet reports none of the new flaws is known to be exploited in the wild, and none of them appears in CISA's Known Exploited Vulnerabilities catalog as of 11 November 2026. That is not a reason to wait: the full technical details are now public, and researchers expect the flaws to be reverse-engineered quickly.
Takeaway
Fortinet's November 2026 release is the new shape of patching: AI found the flaws, the fixes shipped three weeks before the details, and now the details are public. The two 9.8 flaws need no login, the management plane is the target, and the only defence is the fixed build. Check your version today.
If your patch queue is still open from the same week, CERT-In's Chrome zero-day warning from the same week covers the exploited Chrome flaw Indian users should also update, and our Barracuda's exploited Email Security Gateway flaws explainer covers the two Barracuda flaws CISA ordered patched by 13 November — November has been a heavy patching month, and this Fortinet release is the biggest item still open on many lists.
Sources
- Fortinet FortiGuard PSIRT Advisories — November 2026 advisory listing (primary source)
- Fortinet PSIRT FG-IR-26-219 — CVE-2026-126170, FortiManager/FortiAnalyzer JSON-RPC API (primary source)
- Fortinet PSIRT FG-IR-26-199 — CVE-2026-126147, FortiMail path traversal (primary source)
- SecurityWeek — Fortinet Patches Nearly 100 Vulnerabilities (11 November 2026)
- Cyber Security News — Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login (11 November 2026)
- SecurityOnline — Fortinet Critical Vulnerabilities Hit FortiManager, FortiOS (10 November 2026)
- MAG212 CYBER Daily, 11 November 2026 — Barracuda exploited, Outlook zero-day, Xen Orchestra takeover, Fortinet criticals
Comments
Post a Comment