Fortinet has opened a new kernel investigation. The next useful step is to match products, builds and reachable services.
NEW — November 2, 2026: Fortinet published FG-IR-26-188 / CVE-2026-98432, “Linux kernel RCE.” Status: product applicability under investigation. Vendor publication and last verification: November 2, 2026.
Vendor severity: Critical, CVSS v3.1 9.8 (network, unauthenticated, no user interaction). Suggested MSP priority: high for applicability and exposure validation; expedite a supported remediation plan if an exposed deployment is confirmed affected. No customer-specific deadline is assigned.
Where to check
Fortinet lists FortiOS, FortiProxy, FortiManager, FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud, FortiGate Cloud, FortiSwitch, FortiSwitch Manager and FortiSwitch NMS under investigation. The list also includes FortiClient EMS, FortiAuthenticator, FortiPAM, FortiMail, FortiWeb, FortiEDR, FortiSIEM, FortiSOAR and other products. Check the complete current advisory against each actual product and deployment.
No Fortinet affected-version ranges, fixed firmware builds, confirmed product configuration prerequisites or product-specific workaround are published in this initial advisory. Being listed for investigation does not establish that a particular appliance is vulnerable. Earlier hardening firmware or an exclusion in another advisory does not settle FG-IR-26-188 applicability.
What the kernel issue requires
The Linux CNA describes a use-after-free while building a TCP SYN-ACK with saved IPv4 options. An unauthenticated peer can send an option-bearing SYN and race a retransmitted SYN against connection completion and teardown on an accepting server. The CNA describes possible kernel memory disclosure, corruption and denial of service; Fortinet identifies potential unauthorized code or command execution. A related request-migration path is also described. IPv6 is excluded from the first issue; the CNA says the separate IPv6/CALIPSO migration issue will be addressed in another patch.
Upstream context, not Fortinet firmware: the Linux CNA identifies introduction in Linux 4.4 and fixed branch points 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and mainline 7.3. Distribution backports and appliance builds require their own vendor mapping. Do not install a standalone kernel package on a Fortinet appliance.
Exploitation and available protection
Fortinet Known Exploited: No. CVE-2026-98432 is absent from the full CISA KEV catalog reviewed November 2 (catalog version 2026.10.30; 1,766 records). No KEV federal remediation deadline applies to this CVE in that catalog. These facts do not prove a customer installation is clean. No separate public proof-of-concept status was verified.
Fortinet lists Virtual Patch: No. No appliance patch, complete workaround, compromise-check procedure or credential-rotation requirement is supplied. The CVRF/CSAF “final” document status does not close the live product investigation.
MSP action sequence
- Inventory: record exact products, firmware builds, deployment types, HA peers and reachable TCP services across relevant customer environments. Ask the vendor to confirm applicability where versions remain unspecified.
- Reduce unnecessary exposure: retain tested trusted-management restrictions and remove unnecessary service reachability as operational precautions. This kernel issue is not established as management-interface-only, so an admin ACL alone is not verified protection. Preserve required VPN, routing and customer services. Follow incident response if independent signs of compromise exist.
- Remediate through supported guidance: track this advisory for an affected/fixed matrix, then use the product-specific upgrade or mitigation path. Keep investigation tickets open while vendor confirmation or a fix is pending.
- Verify: confirm the vendor’s applicability determination or running fixed firmware on every relevant node; test HA, VPN, routing, management access and logging before closure.
Official sources
- Fortinet FG-IR-26-188
- Fortinet official alternative advisory
- Fortinet CVRF and revision history
- Linux vendor-authored CNA record
- CISA KEV official catalog data
This entry covers a newly published Fortinet investigation. Monitoring gaps for other vendor sources remain; it is not an all-clear for customer environments.