Critical Fortinet Vulnerabilities Expose FortiManager and FortiAnalyzer to Remote Code Execution
FHN 
Fortinet has disclosed multiple critical security vulnerabilities affecting FortiManager, FortiAnalyzer and FortiOS, including flaws that could allow unauthenticated attackers to execute arbitrary code or commands on vulnerable systems.
The disclosures, published on November 10, 2026, cover eight high-severity vulnerabilities involving management APIs, device communication services, routing protocols and high-availability configurations.
Critical Remote Code Execution Vulnerabilities
One of the most severe issues is CVE-2026-126170, which carries a CVSS score of 9.8. The vulnerability affects the JSON-RPC API in FortiManager and FortiAnalyzer. When the JSON API is enabled, specially crafted requests could allow unauthenticated attackers to execute arbitrary code or commands.
Another critical vulnerability, CVE-2026-126261, affects the FGFM service in FortiManager. Rated 9.0, the authorization weakness could allow attackers who can reach the FGFM service to execute code through specially crafted packets, before the registration password is verified.
CVE-2026-126262, rated 9.3, is an SQL injection vulnerability affecting FortiAnalyzer and FortiManager deployments with FortiAnalyzer features enabled. Attackers can exploit the OFTP service without authentication, potentially leading to code execution.
Additional Fortinet Security Flaws
The disclosure includes several other vulnerabilities affecting Fortinet products:
- CVE-2026-126260 (CVSS 9.0): A pre-authentication server-side request forgery (SSRF) vulnerability affecting FortiAnalyzer and FortiManager with FortiAnalyzer features enabled.
- CVE-2026-126254 (CVSS 9.6): A numeric truncation vulnerability in FortiOS BGP handling that requires traffic from a configured iBGP neighbour.
- CVE-2026-126253 (CVSS 9.3): An OSPF authentication bypass that could allow forged routing advertisements.
- CVE-2026-126229 (CVSS 9.1): An access-control vulnerability that could allow an authenticated administrator to access virtual domains (VDOMs) outside their assigned permissions.
- CVE-2026-126259 (CVSS 9.0): A command execution vulnerability involving specific FortiOS high-availability configurations.
These vulnerabilities have different attack requirements and should not all be treated as unauthenticated remote code execution flaws.
Affected Fortinet Products and Patches
The vulnerabilities affect different versions of FortiManager, FortiAnalyzer and FortiOS.
For CVE-2026-126261, affected FortiManager versions include 8.0.0, 7.6.0–7.6.7, 7.4.0–7.4.5 and 7.2.0–7.2.8. Fortinet has addressed the issue in versions 8.0.1, 7.6.8, 7.4.6 and 7.2.9, respectively.
Organizations should review the individual Fortinet security advisories to identify the affected versions and corresponding fixes for each vulnerability.
About the Author
