Multiple critical vulnerabilities in Fortinet products including remote code execution and SSRF disclosed
Multiple security vulnerabilities have been discovered in a broad range of Fortinet products including FortiAnalyzer Cloud, FortiManager Cloud, FortiOS, FortiPAM, FortiSandbox, and FortiSASE. These vulnerabilities allow attackers to perform arbitrary code execution, privilege escalation, data confidentiality breaches, security policy bypass, server-side request forgery (SSRF), and cross-site scripting (XSS). Numerous product versions, primarily those released before specific maintenance updates (e.g., FortiAnalyzer Cloud prior to 7.2.13, 7.4.12, 7.6.8, 8.0.3), are affected. The vendor has published multiple security bulletins on November 10, 2026, detailing these issues and providing patches. Administrators are strongly advised to review these advisories and apply updates to mitigate risks.
Entenda a falha
A vulnerabilidade
Fortinet published a batch of advisories on November 10, 2026 (FG-IR-26-142, 190, 193, 195 and 219 onwards) covering dozens of CVEs across FortiAnalyzer, FortiManager (including the Cloud editions), FortiOS, FortiPAM, FortiSandbox and FortiSASE. CERT-FR lists the impacts as arbitrary code execution, privilege escalation, loss of data confidentiality and integrity, security policy bypass, SSRF and XSS. The articles give no per-CVE severity, attack conditions or authentication requirements. Affected: FortiAnalyzer and FortiManager 7.2.x, 7.4.x, 7.6.x and 8.0.x before 7.2.13, 7.4.12, 7.6.8 and 8.0.2 (FortiAnalyzer Cloud 8.0.x before 8.0.3); FortiOS before 7.2.14, 7.4.13, 7.6.8 and 8.0.2; FortiSandbox 4.4.x before 4.4.9 and 5.0.x before 5.0.6 (Cloud and PaaS also listed before 5.0.6); all FortiPAM 1.x and all FortiSASE versions are listed, with no fixed version stated.
Como foi descoberta
The articles do not say who found these flaws or how. They only state that Fortinet released the security bulletins on November 10, 2026, with patches, and that CERT-FR republished a summary notice (CERTFR-2026-AVI-1499) on November 12, 2026, pointing readers to the vendor bulletins for fixes. CERT-FR lists the impact types as 'not specified by the vendor' in part.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 13:25.
Linha do tempo
-
Multiple critical vulnerabilities in Fortinet products including remote code execution and SSRF disclosed
ler a análise desta fonte ocultar
Multiple security vulnerabilities have been discovered in a broad range of Fortinet products including FortiAnalyzer Cloud, FortiManager Cloud, FortiOS, FortiPAM, FortiSandbox, and FortiSASE. These vulnerabilities allow attackers to perform arbitrary code execution, privilege escalation, data confidentiality breaches, security policy bypass, server-side request forgery (SSRF), and cross-site scripting (XSS). Numerous product versions, primarily those released before specific maintenance updates (e.g., FortiAnalyzer Cloud prior to 7.2.13, 7.4.12, 7.6.8, 8.0.3), are affected. The vendor has published multiple security bulletins on November 10, 2026, detailing these issues and providing patches. Administrators are strongly advised to review these advisories and apply updates to mitigate risks.