Fortinet Patches Eight Critical Flaws in FortiOS, FortiManager and FortiAnalyzer
Fortinet published eight critical security advisories on November 10, 2026, covering FortiOS, FortiManager, FortiAnalyzer and FortiSASE. These Fortinet critical vulnerabilities score between 9.0 and 9.8 on CVSS. The worst, CVE-2026-126170, can let an unauthenticated attacker run code on FortiManager and FortiAnalyzer when the JSON API is enabled.
Six of the eight flaws need no login, and several target FortiManager and FortiAnalyzer services. Fortinet found almost all of them internally, with help from the AI model Claude Mythos. Some fixes are still “upcoming,” so apply workarounds where patches are not yet available.
Entenda a falha
A vulnerabilidade
Fortinet published eight critical advisories on November 10, 2026 (CVSS 9.0 to 9.8) covering FortiOS, FortiManager, FortiAnalyzer and FortiSASE. The worst, CVE-2026-126170 (9.8), is an output encoding flaw in the JSON RPC API that lets an unauthenticated attacker run unauthorized code or commands; the API is disabled by default. Next come CVE-2026-126254 (9.6, numeric truncation in the BGP daemon), CVE-2026-126262 (9.3, SQL injection via crafted OFTP packets, pre-auth) and CVE-2026-126253 (9.3, OSPF authentication bypass from an adjacent network). Also CVE-2026-126229 (9.1, an authenticated admin reaching other VDOMs), CVE-2026-126261 (9.0, improper authorization in FGFM), CVE-2026-126260 (9.0, pre-auth SSRF over OFTP) and CVE-2026-126259 (9.0, missing authentication in HA, only with FGSP standalone-config-sync or autoscale). Affected: FortiOS 7.2.0-7.2.13, 7.4.0-7.4.12, 7.6.0-7.6.7, 8.0.0-8.0.1, and the 7.2, 7.4, 7.6 and 8.0 branches of FortiManager and FortiAnalyzer, plus the cloud variants, FortiSASE and FortiAnalyzer-BigData. Fixed in FortiOS 7.2.14, 7.4.13, 7.6.8, 8.0.2 and FortiManager/FortiAnalyzer 7.2.13, 7.4.12, 7.6.8, 8.0.2; some fixes are still listed as upcoming.
Como funciona
The articles give only short descriptions, so the detail is limited. For the top flaw, a request reaches the JSON RPC API on FortiManager or FortiAnalyzer, and the software fails to encode the output properly, so attacker-controlled data ends up interpreted as code or commands. For the OFTP flaw, crafted OFTP packets reach the service and their content is used in a database query without safe handling, giving SQL injection. In the BGP case, a configured iBGP neighbor sends attributes whose numeric values are truncated, and the malformed attributes then spread to all connected routers. In the OSPF case, route updates are accepted without proper authentication from an adjacent host.
Por que é vulnerável
The articles name the weakness class of each flaw: improper output encoding (JSON RPC API), unsafe handling of input in a SQL query (OFTP), improper authorization (FGFM), missing authentication (HA), a numeric truncation error (BGP daemon) and an authentication bypass (OSPF). Server-side request forgery explains the OFTP SSRF. They do not explain why the bugs went unnoticed or detail what each patch changes beyond moving to fixed versions.
Onde está
No file, function or commit is named; the articles only point to components (JSON RPC API, OFTP, FGFM, BGP daemon, OSPF, HA) and to the rpc-permit setting on admin profiles used as a workaround.
Como foi descoberta
According to the articles, Fortinet found almost all of the flaws internally, with help from the AI model Claude Mythos. CVE-2026-126262 was also reported by JP Morgan Chase's XOR team. Fortinet disclosed them through its November 10, 2026 security advisories and reports no attacks; none of the eight is in CISA's KEV catalog so far.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No public exploit is cited. The article says Fortinet's own scoring marks several of the bugs as having proof-of-concept or functional exploit code, without saying who holds it, and the HA virtual patch carries the label FG-VD-61445.0day. No exploitation has been confirmed. Treat patching as urgent, especially for FortiManager and FortiAnalyzer reachable from untrusted networks.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 21:15.
Linha do tempo
-
Fortinet Patches Eight Critical Flaws in FortiOS, FortiManager and FortiAnalyzer
ler a análise desta fonte ocultar
Fortinet published eight critical security advisories on November 10, 2026, covering FortiOS, FortiManager, FortiAnalyzer and FortiSASE. These Fortinet critical vulnerabilities score between 9.0 and 9.8 on CVSS. The worst, CVE-2026-126170, can let an unauthenticated attacker run code on FortiManager and FortiAnalyzer when the JSON API is enabled.
Six of the eight flaws need no login, and several target FortiManager and FortiAnalyzer services. Fortinet found almost all of them internally, with help from the AI model Claude Mythos. Some fixes are still “upcoming,” so apply workarounds where patches are not yet available.