Fortinet patches critical unauthenticated RCE flaws in FortiOS, FortiManager, FortiAnalyzer and other products (CVE-2026-126170)
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 13/11/2026 00:02; os links antigos trazem para cá.
Fontes: cert.cyber.gouv.fr ↗ gbhackers.com ↗ securityonline.info ↗
On November 10, 2026, Fortinet published a batch of security advisories covering critical vulnerabilities in FortiOS, FortiManager, FortiAnalyzer and FortiSASE. Several of the flaws allow unauthenticated remote code execution. The worst is CVE-2026-126170 (CVSS 9.8), in the JSON-RPC API (gbhackers.com, securityonline.info). securityonline.info counts eight critical advisories with CVSS scores from 9.0 to 9.8. On November 12, CERT-FR (cert.cyber.gouv.fr) widened the scope to FortiAnalyzer Cloud, FortiManager Cloud, FortiPAM and FortiSandbox, and added SSRF and XSS to the impact list. No in-the-wild exploitation is confirmed in the sources. Exposure depends on which services are enabled and how the device is deployed (gbhackers.com).
Entenda a falha
A vulnerabilidade
Fortinet's November 10, 2026 batch is led by CVE-2026-126170 (CVSS 9.8, FG-IR-26-219): an output-encoding/JSON injection flaw in the JSON-RPC API of FortiManager and FortiAnalyzer. An unauthenticated attacker can run code or commands, but only when the JSON API is enabled (disabled by default, per securityonline). Next come CVE-2026-126262 (9.3, SQL injection via OFTP, leading to code execution), CVE-2026-126261 (9.0, FGFM improper authorization, command execution) and CVE-2026-126260 (9.0, pre-auth SSRF over OFTP). FortiOS also has CVE-2026-126254 (9.6, BGP), CVE-2026-126253 (9.3, OSPF authentication bypass), CVE-2026-126229 (9.1, admin crossing VDOMs) and CVE-2026-126259 (9.0, HA missing authentication). Affected: FortiOS 7.2.0-7.2.13, 7.4.0-7.4.12, 7.6.0-7.6.7 and 8.0.0-8.0.1, fixed in 7.2.14, 7.4.13, 7.6.8 and 8.0.2; FortiManager/FortiAnalyzer 7.2 to 8.0, fixed in 7.2.13, 7.4.12, 7.6.8 and 8.0.2, varying by advisory. Some fixes are still 'upcoming' (such as 8.0.3). CERT-FR adds cloud editions, FortiPAM, FortiSandbox and FortiSASE.
Como funciona
For CVE-2026-126170, a request reaches the JSON-RPC API of FortiManager or FortiAnalyzer. The software builds its output from the request data without encoding it correctly, so crafted content is interpreted as code or commands instead of plain data. For FGFM (TCP 541), crafted packets reach the service before the registration password is verified, and the authorization weakness lets commands run. For OFTP (TCP 514), crafted packets feed a SQL query, which can lead to code execution. In BGP, a configured iBGP neighbor can send malformed attributes that trigger a numeric truncation error.
Por que é vulnerável
The causes differ by flaw: improper output encoding (JSON injection) in the JSON-RPC API, an authorization check that happens too late in FGFM, unsanitized input reaching SQL in OFTP, numeric truncation in the BGP daemon, and missing authentication in HA and OSPF. The articles do not detail the code-level fixes. Patches are released per branch, and the JSON API can be restricted as a workaround.
Onde está
No code files or functions are named; the articles point to Fortinet advisories (FG-IR-26-219 for CVE-2026-126170, FG-IR-26-275, 276 and 274 for the FGFM and OFTP flaws) and to the admin profile setting rpc-permit as the workaround.
Como foi descoberta
According to securityonline.info, Fortinet found almost all of these flaws internally, with help from the AI model Claude Mythos, and JP Morgan Chase's XOR team also reported CVE-2026-126262. Fortinet published the advisories on November 10, 2026, and CERT-FR widened the scope on November 12. No exploitation in the wild is confirmed, and none of the eight CVEs is in CISA's KEV catalog.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Only securityonline.info mentions this: it says Fortinet's own scores mark several bugs as having proof-of-concept or functional exploit code. gbhackers.com and CERT-FR do not mention any exploit, and no published copy or author is named, so existence is unconfirmed and access is treated as private. Since the flaws are unauthenticated and affect fleet-management devices, patch or restrict exposure without waiting.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 00:18.
Detalhes técnicos
- CVE-2026-126170 (CVSS 9.8): crafted requests to the JSON-RPC API, when enabled, let an unauthenticated attacker run arbitrary code (gbhackers.com, securityonline.info).
- CVE-2026-126261 (CVSS 9.0): the FGFM service allows unauthenticated command execution through crafted packets (gbhackers.com).
- CVE-2026-126262 (CVSS 9.3): SQL injection over SSH via OFTP, which could lead to code execution (gbhackers.com).
- Further flaws affect BGP and OSPF protocol handling, authorization bypasses and admin privilege escalations (gbhackers.com).
- The affected surfaces are management APIs, device communication protocols, routing and high-availability configurations (gbhackers.com).
- The overall impact of the batch includes arbitrary code execution, privilege escalation, loss of data confidentiality, security policy bypass, SSRF and XSS (cert.cyber.gouv.fr).
- Many versions released before specific maintenance updates are affected. For example, FortiAnalyzer Cloud is affected before 7.2.13, 7.4.12, 7.6.8 and 8.0.3 (cert.cyber.gouv.fr).
- Compromised management and network-control devices such as FortiGate firewalls could lead to operational disruption or data breaches (gbhackers.com, securityonline.info).
Remediação
- Apply the Fortinet patches listed in the November 10, 2026 advisories for each affected product and branch (gbhackers.com, cert.cyber.gouv.fr).
- Review which services are exposed (JSON-RPC API, FGFM, OFTP and others) and restrict access as a temporary mitigation until patching is done (gbhackers.com).
- CERT-FR strongly advises administrators to review all the bulletins and update (cert.cyber.gouv.fr).
Relatos divergentes
- Exploitation status: securityonline.info (earliest source) says some flaws are "actively exploitable" with proof-of-concept or functional exploit code available, but also that no attacks have been confirmed. gbhackers.com and cert.cyber.gouv.fr report no exploitation and do not mention public exploit code. Treat exploit availability as unconfirmed.
- Scope: securityonline.info and gbhackers.com name FortiOS, FortiManager, FortiAnalyzer and, for securityonline.info, FortiSASE. cert.cyber.gouv.fr, the latest source (November 12), lists a broader set of products, including cloud variants, FortiPAM and FortiSandbox. It is the most complete scope statement.
Linha do tempo
-
Multiple critical vulnerabilities in Fortinet products including remote code execution and SSRF disclosed
ler a análise desta fonte ocultar
Multiple security vulnerabilities have been discovered in a broad range of Fortinet products including FortiAnalyzer Cloud, FortiManager Cloud, FortiOS, FortiPAM, FortiSandbox, and FortiSASE. These vulnerabilities allow attackers to perform arbitrary code execution, privilege escalation, data confidentiality breaches, security policy bypass, server-side request forgery (SSRF), and cross-site scripting (XSS). Numerous product versions, primarily those released before specific maintenance updates (e.g., FortiAnalyzer Cloud prior to 7.2.13, 7.4.12, 7.6.8, 8.0.3), are affected. The vendor has published multiple security bulletins on November 10, 2026, detailing these issues and providing patches. Administrators are strongly advised to review these advisories and apply updates to mitigate risks.
-
Fortinet Discloses Multiple Critical Unauthenticated RCE Vulnerabilities in FortiManager, FortiAnalyzer, and FortiOS
ler a análise desta fonte ocultar
On November 10, 2026, Fortinet disclosed several critical security vulnerabilities affecting FortiManager, FortiAnalyzer, and FortiOS, which include flaws that could allow remote attackers to execute code without authentication. These vulnerabilities involve management APIs, device communication protocols, routing, and high availability configurations, with exposure depending on the services enabled and deployment settings. Notably, CVE-2026-126170 (CVSS 9.8) affects the JSON-RPC API, permitting crafted requests to run arbitrary code. CVE-2026-126261 (CVSS 9.0) impacts the FGFM service, allowing unauthenticated command execution via crafted packets. CVE-2026-126262 (CVSS 9.3) involves SSH-based SQL injection through OFTP, which could lead to code execution. Additional vulnerabilities concern BGP and OSPF protocol handling, authorization bypasses, and admin privilege escalations. Fortinet recommends immediate review of service exposure, temporary mitigations such as restricting access, and applying patches in the affected versions listed in the advisories. Threat actors exploiting these flaws could potentially compromise affected network devices, leading to operational disruptions or data breaches.
-
Fortinet releases patches for eight critical vulnerabilities impacting FortiOS, FortiManager, and FortiAnalyzer
ler a análise desta fonte ocultar
Fortinet has issued eight critical security advisories affecting multiple products including FortiOS, FortiManager, FortiAnalyzer, and FortiSASE. These flaws carry CVSS scores ranging from 9.0 to 9.8, with the most severe, CVE-2026-126170, enabling unauthenticated attackers to execute code via the JSON RPC API when enabled. Several vulnerabilities do not require login, and some are actively exploitable with proof-of-concept or functional exploit code available. While no attacks have been confirmed, these flaws pose a significant risk given their impact on network control devices like FortiGate firewalls.