Fortinet patches four critical flaws: FortiOS OSPF, FortiManager FGFM, FortiAnalyzer and FortiAuthenticator

What happened

On Tuesday 10 November 2026, as part of its regular monthly release, Fortinet published at least 50 security advisories (that is how many its FortiGuard RSS feed lists for the day). Most are rated High or Medium – SQL injection, OS command injection, path traversal and access-control bugs across FortiManager, FortiAnalyzer, FortiOS and other products. Four are Critical:

For all four, Fortinet says it is not aware of exploitation and offers neither a virtual patch nor a workaround. All were found by members of Fortinet's internal Product Security team using the Claude Mythos AI model.

Technical details

The details come from Fortinet's advisories. As of 11 November 2026 NVD has published only the CVE-2026-126261 record (status "Received", not yet analysed by NVD); the other three records are still missing and no third-party technical write-up exists. We do not publish exploitation steps.

• FortiManager FGFM (CVE-2026-126261, CVSS 9.8): FGFM is the protocol FortiGate devices use to register with and talk to FortiManager. According to the advisory, FortiManager elevates the connection's privileges before it verifies the registration password. An attacker with no account who can reach the FGFM port can therefore run code or commands with crafted packets. The vector AV:N/AC:L/PR:N/UI:N means a network attack with no login and no user interaction. The advisory shows 9.0, but that is the temporal score, which factors in that no exploit is known and a fix exists (E:U/RL:O/RC:C); the base score Fortinet submitted to NVD is 9.8, and that is the number to prioritise by. The same part of FortiManager was hit in October 2024 by FortiJump (CVE-2024-47575), which attackers used to steal the configurations of managed devices.
• FortiOS OSPF (CVE-2026-126253, CVSS 9.3): a bug in the OSPF (dynamic routing) daemon lets an unauthenticated attacker broadcast spoofed link-state advertisements (LSAs). The vector AV:A/…/S:C/C:N/I:H/A:H says the attacker must be on an adjacent network and cannot read data, but can seriously damage integrity and availability – typically by redirecting or black-holing traffic with forged routes. The temporal metric E:P means Fortinet considers a proof of concept to exist; it is not public.
• FortiManager and FortiAnalyzer dmserver (CVE-2026-126229, CVSS 9.1): an authenticated administrator can use crafted HTTP requests to reach other VDOMs than the ones they are assigned to. This matters most to service providers and large organisations that separate customers or branches inside one FortiManager.
• FortiAuthenticator (CVE-2026-126257, CVSS 9.0): a hard-coded password lets an unauthenticated attacker bypass credential validation "in certain circumstances" and escalate privileges. Fortinet does not describe the circumstances; the high attack complexity (AC:H) suggests extra conditions must be met.

Who is affected

• The OSPF advisory does not list FortiOS 7.0 or older branches. FortiSASE 22.4–24.4 is not affected by the OSPF bug.
• The most exposed systems are FortiManagers with the FGFM port reachable from the internet – often to manage branch FortiGates without a VPN.

How to tell if you were compromised

Fortinet has not published indicators of compromise. What we suggest watching (our own advice, not Fortinet's):

• FortiManager: unknown devices in the managed list (including unauthorised ones), FGFM connections from addresses that are not your FortiGates, new admin accounts and unexpected config exports. Fortinet's guidance for FortiJump in 2024 is a useful model.
• FortiOS with OSPF: new OSPF neighbours, unexpected routing-table changes and LSAs from unknown routers (get router info ospf neighbor, get router info ospf database brief).
• FortiAuthenticator: admin logins from unusual addresses and changes to authentication settings.
• FortiManager/FortiAnalyzer: admins accessing VDOMs they are not assigned to (audit log).

If Fortinet or a CERT publishes indicators, you can pull them out of the report with our IOC extractor. You can recalculate the vectors in the CVSS calculator.

What to do

1. FortiManager with FGFM reachable from the network: upgrade as soon as possible (8.0.1, 7.6.8, 7.4.6, 7.2.9). Until then, allow the FGFM port only from your FortiGates' addresses.
2. FortiAuthenticator: upgrade to 8.0.4 or 6.6.11 and restrict management access to the internal network.
3. FortiOS: upgrade to 8.0.2, 7.6.8, 7.4.13 or 7.2.14, devices running OSPF first. In the meantime, enable OSPF only on the interfaces that need it (set the rest to passive) and keep it out of user and guest segments.
4. FortiManager and FortiAnalyzer (VDOM): upgrade to 8.0.2, 7.6.8 or 7.4.12; the 7.2 branch has to go. Review who holds administrator accounts.
5. Check the upgrade path in Fortinet's tool (docs.fortinet.com/upgrade-tool) and go through the remaining 10 November advisories for the products you run.

Timeline

Updates

• 11 Nov 2026 (evening) – NVD published the CVE-2026-126261 record: Fortinet's CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-285. The 9.0 in the advisory is the temporal score. We updated the table, summary and timeline. NVD still has no records for the other three CVEs; none of the flaws is in CISA KEV.
• 11 Nov 2026 – first version of this article.