Fortinet has published a dense round of security advisories covering FortiManager, FortiAnalyzer, and FortiOS, with several of the flaws rated critical and exploitable without any login credentials at all. The disclosures, released November 10, 2026, touch management APIs, device-to-device communication services, and core routing protocols — a spread that means exposure varies considerably depending on which features an organization has enabled and which ports are reachable from outside.

The Headline Flaw: A Perfect 9.8 in the Management API

The most severe issue, CVE-2026-126170, carries a near-maximum CVSS score of 9.8. Tracked internally as FG-IR-26-219, it stems from JSON injection in the JSON-RPC API shared by FortiManager and FortiAnalyzer. When that API is enabled — commonly the case in environments that automate device management — a specially crafted request could let an unauthenticated attacker execute arbitrary code or commands on the appliance. Organizations relying on the JSON API for scripted operations should treat this as a priority patch, and Fortinet’s guidance notes that disabling unused API access with set rpc-permit none can reduce exposure while an update is scheduled.

Two More Pre-Authentication Paths to Code Execution

A second critical bug, CVE-2026-126261, rated 9.0, affects FortiManager’s FGFM service — the proprietary protocol FortiGate devices use to communicate with central management. The authorization flaw occurs before the registration password is even checked, meaning an attacker who can simply reach the FGFM port (TCP 541) may be able to send crafted packets that lead to code execution, without needing valid credentials of any kind.

A related issue, CVE-2026-126262 (rated 9.3), exposes systems running FortiAnalyzer features to SQL injection through the OFTP log-transfer protocol on TCP port 514. Like the FGFM flaw, no authentication is required, and successful exploitation can lead to code execution. A separate but related bug, CVE-2026-126260 (rated 9.0), is a pre-authentication server-side request forgery issue in the same OFTP service — distinct from the SQL injection flaw, since SSRF causes the server to make attacker-directed requests rather than directly executing code.

Fortinet’s advisories make an important point that’s easy to miss: protecting the web-based administrative login page does nothing to shield these services, because FGFM and OFTP run on entirely separate ports that a typical “restrict access to the login page” policy wouldn’t cover.

Routing Protocols and Privilege Boundaries Also Affected

The disclosure batch isn’t limited to management-plane bugs. CVE-2026-126254, rated 9.6, is a numeric truncation flaw in FortiOS’s BGP handling that requires traffic from a configured iBGP neighbor to trigger — a meaningfully different, more constrained attack surface than an internet-facing API. CVE-2026-126253 (9.3) involves an OSPF authentication bypass that could allow forged routing advertisements onto a network.

Two more issues affect privilege boundaries rather than remote access. CVE-2026-126229 (9.1) could let an authenticated administrator break out of their assigned virtual domain (VDOM) and access others they shouldn’t be able to reach. CVE-2026-126259 (9.0) allows command execution with super-admin privileges, but only in specific configurations involving FGSP standalone configuration synchronization or certain autoscale setups — it is not a universal risk across all FortiOS deployments.

What Hasn’t Changed Since October

These disclosures follow Fortinet’s October security releases, which the company had already flagged in earlier guidance. Fortinet released patched builds ahead of publishing the detailed November advisories, giving customers a head start on upgrading — but administrators should not assume that an October update already closes every gap found this round, since fixes are tied to specific vulnerabilities and software branches.

For the FGFM flaw specifically, Fortinet’s advisory lists FortiManager 8.0.0, the 7.6.0–7.6.7 range, 7.4.0–7.4.5, and 7.2.0–7.2.8 as affected, with fixes available in 8.0.1, 7.6.8, 7.4.6, and 7.2.9 respectively. As of publication, Fortinet says it has no evidence that CVE-2026-126261 has been exploited in the wild — though that status can change quickly once technical details circulate.

Recommended Actions

• Patch FortiManager, FortiAnalyzer, and FortiOS to the fixed builds listed in each individual advisory — don’t assume one update covers every CVE
• Audit whether the JSON-RPC API, FGFM, and OFTP services are reachable from untrusted networks, independent of web login restrictions
• Disable unused JSON API access with set rpc-permit none as an interim mitigation
• Review VDOM access controls and FGSP/autoscale configurations for unnecessary privilege exposure
• Back up device configurations before upgrading and monitor for unauthorized configuration changes afterward

Given the number of pre-authentication, high-severity paths in this release — several bypassing the login screen outright — organizations running FortiManager or FortiAnalyzer with internet-reachable management services should move patching up the priority list rather than waiting for a routine maintenance window.