Fortinet’s November hardening advisories cover more than FGFM and OFTP. Check RADIUS trust, HA reachability and who can reach the management API before choosing a branch.
What changed — November 10, 2026; reverified after publication. Fortinet’s live matrices differ from the earlier snapshot, although both timelines still say initial publication. FG-IR-26-274 / CVE-2026-126260 expands FortiManager 7.6 exposure through 7.6.7 and now requires 7.6.8 or later. FG-IR-26-275 / CVE-2026-126261 now lists FortiManager 7.4.0–7.4.5 → 7.4.6+ and 7.2.0–7.2.8 → 7.2.9+, replacing the earlier all-branch migration guidance. FortiAnalyzer rows were removed from 275; its summary names FortiManager. Reassess that CVE by product, while retaining the separate FortiAnalyzer OFTP/JSON API tickets. Last verified November 10, 2026.
Fortinet published these advisories November 10, 2026. Its reviewed advisories mark known exploitation as No, and CISA KEV did not list these CVEs at verification November 11, 2026. Scores below are Fortinet’s CVSS 3.1 values.
What Fortinet disclosed
FG-IR-26-275 · CVE-2026-126261 · Critical 9.0. Unauthenticated code or command execution for an attacker who can reach FGFM. The current summary and matrix name FortiManager.
FG-IR-26-276 · CVE-2026-126262 · Critical 9.3 and FG-IR-26-274 · CVE-2026-126260 · Critical 9.0. Reachable OFTP exposes unauthenticated code execution or server-side requests on FortiAnalyzer and FortiManager with FortiAnalyzer features.
| CVE and product | Affected → fixed |
|---|---|
| 126261 · FortiManager | 8.0.0 → 8.0.1+. 7.6.0–7.6.7 → 7.6.8+. 7.4.0–7.4.5 → 7.4.6+. 7.2.0–7.2.8 → 7.2.9+. |
| 126262 · FortiAnalyzer | 8.0.0–8.0.1 → 8.0.2+. 7.6.0–7.6.7 → 7.6.8+. 7.4.0–7.4.11 → 7.4.12+. 7.2.0–7.2.12 → 7.2.13+. |
| 126262 · FortiManager with analyzer features | 8.0.0 → 8.0.1+. Remaining ranges and fixes match FortiAnalyzer for this CVE. |
| 126260 · FortiAnalyzer and FortiManager with analyzer features | 8.0.0 → 8.0.1+. Both 7.6.0–7.6.7 → 7.6.8+. Both 7.4.0–7.4.11 → 7.4.12+. Both 7.2 unaffected. |
Management trust paths. FG-IR-26-244 / CVE-2026-126229 (Critical 9.1) allows an authenticated administrator to access other VDOMs on Manager/Analyzer and their cloud counterparts. FG-IR-26-225 / CVE-2026-126180 (High 8.4) allows a low-privilege Device Manager administrator to obtain super-admin access on managed FortiGates according to Fortinet’s summary. Fortinet’s separate impact label for 126180 says denial of service. The common fixes are 8.0.2+, 7.6.8+ or 7.4.12+, and migration from 7.2. Consult the linked product rows for cloud-specific lower bounds.
Check the JSON API and SAML separately
FG-IR-26-219 · CVE-2026-126170 · Critical 9.8. An unauthenticated attacker who can reach the management GUI may execute code or commands when the JSON API is enabled. The API is disabled by default. FortiManager and FortiAnalyzer 8.0.0–8.0.2 and their cloud counterparts 8.0.1–8.0.2 need the vendor’s workaround while 8.0.3 is upcoming. Fortinet directs disabling JSON API access on the affected admin profiles. Check dependent automation before making the change. For those four products, 7.6.0–7.6.7 → 7.6.8+, and 7.4 and 7.2 are unaffected by this CVE. FortiAnalyzer-BigData 7.6.0–7.6.2 needs the workaround pending 7.6.3. Fortinet lists FortiSASE-Sovereign 25, 25.3 and 25.4 for migration and says its remediated 26.2 was not released.
FG-IR-26-222 · CVE-2026-126176 and CVE-2026-126177 · High 8.1. Reachable SAML endpoints on FortiManager and FortiAnalyzer, including cloud, can allow an unauthenticated remote attacker to inject content into a signed SAML response. For all four, 8.0.0 → 8.0.1+, and 7.6.0–7.6.7 → 7.6.8+. On premises, 7.4.0–7.4.11 → 7.4.12+, and 7.2.0–7.2.12 → 7.2.13+. The cloud 7.4 and 7.2 affected ranges start at .1 and use the same fixes.
FG-IR-26-226 · CVE-2026-126181 · High 8.0. A user with adjacent access and the required permission can join the configuration-sync mesh for an affected FortiGate deployment managed through FortiManager cloud orchestration. For the FortiManager product rows, 8.0.0–8.0.1 → 8.0.2+, 7.6.0–7.6.7 → 7.6.8+, 7.4.0–7.4.11 → 7.4.12+, and all 7.2 require migration.
Suggested MSP priority · urgent where reachable
Inventory on-premises and cloud products separately. Confirm FGFM and OFTP reachability, analyst and Device Manager permissions, managed-device trust and customer VDOM boundaries. Restrict ports to approved management and logging peers while rolling out the supported upgrade. Fortinet lists no virtual patch for the three unauthenticated advisories. Verify running builds, manager registration, log ingestion, HA and cross-tenant access controls. Preserve logs and review unexpected configuration or privileged activity if found.
What changed · November 11, 2026
Four additional Fortinet advisories published November 10 were verified November 11. Fortinet rates each High, reports known exploitation as No and lists no virtual patch. None appeared in CISA KEV at verification. The scores below are Fortinet’s CVSS v3 base scores.
FG-IR-26-247 · CVE-2026-126232 · 7.5. Where RADIUS is used, an on-path attacker can impersonate the RADIUS server. FortiManager and FortiAnalyzer 8.0.0–8.0.1 → 8.0.2+, 7.6.0–7.6.7 → 7.6.8+, 7.4.0–7.4.11 → 7.4.12+. Their Cloud variants start at 8.0.1 and 7.4.1 for those branches, with the same fix floors. All four 7.2 trains require migration. FortiSASE Sovereign 25, 25.3 and 25.4 require migration. Fortinet lists 26.2 as fixed before release with no customer action.
FG-IR-26-229 · CVE-2026-126184 · 8.2. Unauthenticated spoofing can disrupt fortilogd HA. The 8.0, 7.6 and 7.4 ranges and fixes match the RADIUS rows. For 7.2, appliance 7.2.0–7.2.12 and Cloud 7.2.1–7.2.12 → 7.2.13+. The summary names FortiAnalyzer BigData and FortiSASE Sovereign without a version matrix.
FG-IR-26-221 · CVE-2026-126175 · 8.8. An authenticated JSON-RPC caller can execute code or commands. FortiManager and FortiAnalyzer on premises 7.6.0–7.6.7 → 7.6.8+, 7.4.0–7.4.11 → 7.4.12+, and 7.2.2–7.2.12 require migration. FortiAnalyzer Cloud 7.6 has the same range, 7.4.1–7.4.11 → 7.4.12+, and 7.2.2–7.2.12 → 7.2.13+. FortiManager Cloud 7.4 and 7.6 all releases and 7.2.2–7.2.13 require migration. All listed 8.0 trains are unaffected by this CVE.
FG-IR-26-190 · CVE-2025-61625 · 7.3. An authenticated read-only API profile can write or delete appliance files. FortiManager and FortiAnalyzer 7.6.0–7.6.4 → 7.6.5+, 7.4.0–7.4.7 → 7.4.8+, and 7.2.0–7.2.11 → 7.2.12+. FortiManager Cloud has the same 7.6 range and fix, 7.4.1–7.4.7 → 7.4.8+, and 7.2.1–7.2.10 → 7.2.11+. Listed 8.0 trains are unaffected by this CVE.
Suggested MSP priority. Expedite where these trust paths are exposed. Inventory each product and service tier, RADIUS paths, HA peers and API profiles. Restrict untrusted reachability while patching. Confirm cloud changes with the vendor, then test authentication, HA synchronization and API permissions on the deployed versions.
FG-IR-26-190 · FG-IR-26-221 · FG-IR-26-229 · FG-IR-26-247
Official sources
FG-IR-26-275 · FG-IR-26-276 · FG-IR-26-274 · FG-IR-26-244 · FG-IR-26-225 · FG-IR-26-219 · FG-IR-26-222 · FG-IR-26-226 · Fortinet upgrade path tool · CISA KEV data