Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login

Fortinet has disclosed critical security flaws affecting FortiManager, FortiAnalyzer, and FortiOS, including weaknesses that could let attackers execute code without logging in.

Published on November 10, 2026, the disclosures cover management APIs, device communication services, routing, and specific high availability setups. Attack requirements differ, making enabled features and network access central to assessing exposure.

Critical Fortinet Flaws Patched

The highest-rated issue, CVE-2026-126170, carries a CVSS score of 9.8. Tracked as FG-IR-26-219, it involves JSON injection in the JSON-RPC API used by FortiManager and FortiAnalyzer. When the JSON API is enabled, crafted requests could allow an unauthenticated attacker to execute code or commands. Systems using the API for automation need close review.

Another critical flaw, CVE-2026-126261, affects FortiManager’s FGFM service. Rated 9.0 and tracked as FG-IR-26-275, the authorization weakness allows attackers who can reach the FGFM port to send crafted packets and potentially execute code. The problem occurs before the registration password is verified, placing the service itself within the attack path.

CVE-2026-126262, tracked as FG-IR-26-276 and rated 9.3, exposes FortiAnalyzer and FortiManager systems with FortiAnalyzer features enabled to SQL injection through OFTP. An attacker does not need to log in, and successful exploitation could lead to code execution. This makes access to the log transfer service an important part of exposure checks.

The disclosures follow the October security releases previously covered in Cyber Security News’ Fortinet patch warning. Fortinet released updates before publishing the detailed advisories, giving customers time to upgrade. However, administrators should not assume that installing one October build resolves every November finding, because fixes vary by vulnerability and software branch.

Fortinet’s FGFM advisory lists FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 as affected by CVE-2026-126261. Fixed releases are 8.0.1, 7.6.8, 7.4.6, and 7.2.9, respectively. Fortinet marks this issue as not known to have been exploited when published.

CVE-2026-126260, tracked as FG-IR-26-274, adds a separate OFTP risk. Rated 9.0, this pre-authentication server-side request forgery flaw affects FortiAnalyzer and FortiManager with FortiAnalyzer features enabled. It should not be confused with confirmed remote code execution. Its impact involves causing the server to make requests, while the SQL injection issue provides a different attack path.

These weaknesses also show why protecting the browser login page is not enough. FGFM uses TCP port 541, while OFTP uses TCP port 514. Administrative login restrictions do not directly protect those services. Earlier FortiManager compromise reporting showed how access to a central management appliance could expose sensitive information linked to hundreds of managed firewalls.

Routing and Access Controls Also Affected

The broader release includes CVE-2026-126254, a 9.6-rated numeric truncation flaw in FortiOS BGP handling that requires traffic from a configured iBGP neighbor. CVE-2026-126253, rated 9.3, concerns an OSPF authentication bypass that could permit forged routing advertisements. These are routing risks, not interchangeable examples of management server code execution.

CVE-2026-126229, rated 9.1, could allow an authenticated administrator to access other virtual domains, or VDOMs, outside their permitted scope. Separately, CVE-2026-126259 carries a 9.0 rating and allows command execution with super-admin privileges in specific FortiOS setups involving FGSP with standalone configuration synchronization, or affected autoscale configurations. Neither issue should be described as affecting every deployment equally.

Fortinet’s security release guidance urges customers to prioritize exposed systems, back up configurations, and monitor unauthorized changes. For CVE-2026-126170, the 8.0 branch requires particular attention because 8.0.3 was listed as forthcoming. Disabling unused JSON API access with set rpc-permit none reduces exposure while administrators verify the latest advisory and plan the appropriate update.

The post Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login appeared first on Cyber Security News.