Fortinet has released fixes for twelve vulnerabilities across FortiOS, FortiMail, FortiManager, FortiAnalyzer and FortiAuthenticator, four of them rated critical. The most severe, scored 9.3, sits in the FortiOS routing daemon and can be reached by an attacker who needs no login. None of the twelve is marked as known exploited, but Fortinet gear is a perennial target, so administrators should patch before that changes.
The batch, published on November 10, 2026, also shows how these bugs are now being found. Most of the critical ones were discovered internally by Fortinet's Product Security team "with the use of the frontier AI model: Claude Mythos", according to the advisories, continuing a pattern we noted in October.
Four critical flaws, worst first
- FortiOS and FortiSASE OSPF daemon, CVSS 9.3 (FG-IR-26-267, CVE-2026-126253): an authentication bypass that Fortinet says may allow an unauthenticated attacker to broadcast LSA (the link-state advertisements OSPF routers use to share routes) via a specially crafted request. Fixed in FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14; FortiOS 7.0 users must migrate to a fixed release. Found by Loic Pantano.
- FortiMail, CVSS 9.1 (FG-IR-26-208): an authorization bypass that may let an unauthenticated remote attacker take over an arbitrary IBE recipient account via crafted HTTP requests. Fixed versions are listed in Fortinet's advisory.
- FortiManager and FortiAnalyzer, CVSS 9.1 (FG-IR-26-244, CVE-2026-126229): a flaw in dmserver that could let an authenticated administrator access other VDOMs. Fixed in 8.0.2, 7.6.8 and 7.4.12 for both products and their cloud editions; 7.2 and 7.0 must migrate. Found by Loic Pantano.
- FortiAuthenticator, CVSS 9.0 (FG-IR-26-271, CVE-2026-126257): a hard-coded password that may let an unauthenticated attacker bypass credential validation, Fortinet says, "in certain circumstances outside of the attacker's control". Fixed in 8.0.4 and 6.6.11. Found by Gwendal Guegniaud.
Eight more rated high or medium
- FortiManager GUI, CVSS 8.7 (FG-IR-26-228, CVE-2026-126183): authenticated command execution outside the expected scope, only where the JSON API is enabled on a profile (it is off by default). Fixed in 8.0.2, 7.6.8, 7.4.12 and 7.2.13.
- FortiManager, CVSS 8.2 (FG-IR-26-235): an authenticated attacker with admin permission may elevate to root.
- FortiAnalyzer and FortiManager fortilogd, CVSS 8.2 (FG-IR-26-229): authentication bypass by spoofing that may disrupt the HA state.
- FortiMail, CVSS 8.1 (FG-IR-26-204): an authenticated attacker may delete directories as root or reach other users' calendar and mailbox data across tenant domains.
- FortiMail, CVSS 7.5 (FG-IR-26-211, CVE-2026-126159): unauthenticated release or deletion of quarantined messages for arbitrary mailboxes. Fixed in 8.0.2, 7.6.7 and 7.4.9; FortiMail Cloud was fixed on October 5.
- FortiAuthenticator, CVSS 7.5 (FG-IR-26-258): unauthenticated denial of service through resource exhaustion.
- FortiManager and FortiAnalyzer API, CVSS 7.3 (FG-IR-26-190): a path traversal that may let a read-only profile write and delete files.
- FortiOS 7.6, CVSS 5.9 (FG-IR-26-195, CVE-2026-121530): a remote RADIUS admin two-factor login flaw, reported by Juan A. Zavala of EchoStar/HUGHES. Fixed in 7.6.7.
Upgrade first, use the JSON API and RADIUS workarounds if you cannot
Move to the fixed builds above using Fortinet's upgrade path tool, starting with FortiOS devices running OSPF and internet-facing FortiMail. Where FortiManager cannot be upgraded right away, Fortinet's workaround for the GUI flaw is to disable the JSON API on admin profiles with set rpc-permit none. For the FortiOS 7.6 RADIUS issue, the workaround is to remove Remote RADIUS Type administrator accounts tied to a RADIUS server that sends an extra Access-Challenge after a failed token.
Edge and management appliances have been a steady target all year, as recent access-broker activity shows. A batch with no known exploitation is the rare chance for defenders to move first.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.