Multiple Security Flaws Affecting Fortinet Products (November 2026 PSIRT Release)
Fortinet has published an extensive set of nearly 90 security advisories addressing close to 100 vulnerabilities across its product ecosystem, including FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiWeb, FortiClient, and FortiSASE. Approximately 17 vulnerabilities are classified as Critical severity, and nearly 80 are rated High severity. The security flaws encompass remote code execution (RCE), authentication and authorization bypasses, SQL injection, and OS command...
Description
Technical context and vulnerability details
Fortinet's November 2026 Monthly PSIRT update represents one of the vendor's largest coordinated security disclosures, targeting core enterprise networking and security infrastructure:
-
Authentication Bypass in FortiOS OSPF Daemon (CVE-2026-126253, CVSS 9.3): A critical authentication vulnerability in the FortiOS Open Shortest Path First (OSPF) routing daemon allows an unauthenticated remote attacker on the adjacent network to inject or alter routing information, potentially intercepting or disrupting routing domains.
-
Critical SQL Injection and API Handling in FortiManager and FortiAnalyzer (CVE-2026-126262, CVE-2026-126170): Improper sanitization of user-supplied input in specific JSON API endpoints and database query handlers allows authenticated or unauthenticated attackers (depending on management exposure) to execute arbitrary database queries, extract sensitive credentials, or manipulate device inventories.
-
Command Injection and Path Traversal in FortiMail and FortiWeb: Multiple vulnerabilities involving improper neutralization of special elements in administration and processing scripts allow attackers to execute arbitrary system commands or read arbitrary files across appliances.
While Fortinet reports that none of these flaws were actively exploited in the wild at the time of publication, the disclosure of technical details and patch diffs provides attackers with sufficient indicators to develop functional exploits rapidly.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote code execution (RCE) with elevated privileges across network perimeter appliances;
- Unauthenticated authentication and authorization bypass;
- Exposure and alteration of dynamic network routing configurations;
- Arbitrary database query execution and data extraction via SQL injection;
- Compromise of centralized firewall and log management systems (FortiManager/FortiAnalyzer);
- Denial of service (DoS) impacting enterprise network connectivity.
Affected systems
Products, components and targeted versions
- FortiOS versions prior to patched maintenance releases;
- FortiManager and FortiAnalyzer;
- FortiMail and FortiWeb;
- FortiClient and FortiClientEMS;
- FortiSASE cloud and on-premises components.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Upgrade all impacted Fortinet appliances to the latest patched firmware releases specified in the individual FortiGuard PSIRT advisories;
- Restrict access to administrative interfaces (HTTPS, SSH, API) strictly to trusted management subnets or dedicated out-of-band networks;
- Disable administrative access on external/WAN-facing interfaces;
- Verify routing protocol authentication and filter untrusted OSPF neighbor peering;
- Audit management logs for anomalous authentication attempts, unauthorized API calls, or unexpected configuration changes.
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.