Fortinet’s November 10 security advisories include four critical vulnerabilities affecting FortiManager, FortiAnalyzer and FortiClient. Three affect management services and can lead to unauthenticated code execution, while a fourth is an origin-validation flaw in FortiClient that can let a remote attacker execute code or commands after the victim interacts with attacker-controlled content. The management flaws carry CVSS scores of 9.8, 9.3 and 9.0. Fortinet’s CVE record rates the FortiClient issue 9.1, while NVD lists it as 9.6.
The highest-rated issue, CVE-2026-126170, affects the JSON-RPC API used by FortiManager and FortiAnalyzer. A crafted HTTP request could trigger code or command execution without authentication when the JSON API is enabled. Fortinet’s advisory, FG-IR-26-219, lists version 8.0.3 as forthcoming for the 8.0 branch.
CVE-2026-126261 affects FortiManager’s FGFM service. An unauthenticated attacker who can reach the service can send crafted packets that are processed before the registration password is verified, potentially allowing code or command execution. Fortinet lists FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 as affected. The corresponding fixes are 8.0.1, 7.6.8, 7.4.6 and 7.2.9. Fortinet said it was not aware of exploitation of this flaw when the advisory was published.
CVE-2026-126262 is a SQL injection flaw in the OFTP service, rated CVSS 9.3. It affects FortiAnalyzer and FortiManager systems with FortiAnalyzer features enabled, and a remote attacker does not need to authenticate before sending crafted traffic that could lead to code or command execution. Fortinet’s advisory lists affected configurations and fixes by product branch.
CVE-2026-121529 affects FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7 and 7.2.0 through 7.2.14, plus FortiClientWindowsPAM 7.4.7 and 7.2.14. The origin-validation error requires user interaction, but the CVE description says an attacker does not need prior privileges or authentication. NVD’s record currently gives the flaw a CVSS score of 9.6, compared with 9.1 in Fortinet’s CVE record. It is separate from the earlier FortiClient zero-day used with the DeepData toolkit.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
