Fortinet's November Patch Wave Fixes Pre-Auth Flaws in FortiManager, FortiMail and FortiAnalyzer — FGFM Code Execution CVE-2026-126261 and FortiMail Command Injection Lead ~89 Advisories

Critical · 2026-11-12 · By H.A

Fortinet fixed unauthenticated code execution in FortiManager's FGFM service, five critical FortiMail flaws, OFTP SQL injection and SSRF in FortiAnalyzer, and FortiAuthenticator and FortiOS bugs, none yet exploited but all on historically targeted appliances.

Overview

Fortinet's November 2026 PSIRT release, published on 10 November, is one of its heaviest in years. It contains roughly 89 advisories, more than a dozen rated Critical. The most dangerous need no login:

• a FortiManager FGFM flaw that runs code before the device-registration password is checked;
• a set of FortiMail bugs reaching path traversal, SQL injection and command injection;
• FortiAnalyzer OFTP bugs that expose the log-collection service.

Fortinet marks every advisory as not known to be exploited, and none was in the CISA KEV catalog as of 11 November. Fortinet management and email appliances have repeatedly been exploited shortly after disclosure, so treat this release as urgent.

The Vulnerability

FortiManager – CVE-2026-126261 (FG-IR-26-275), CVSS 9.0. An improper-authorization weakness (CWE-285) in the FortiGate-to-FortiManager (FGFM) protocol lets an unauthenticated attacker who can reach the FGFM port run code or commands with crafted packets. Privileges are elevated before the registration password is verified. Affected: 8.0.0, 7.6.0–7.6.7, 7.4.0–7.4.5 and 7.2.0–7.2.8. Fixed: 8.0.1, 7.6.8, 7.4.6, 7.2.9. No workaround or virtual patch is listed.

FortiManager / FortiAnalyzer – other critical issues:

• CVE-2026-126262 (FG-IR-26-276), CVSS 9.3: unauthenticated SQL injection over the OFTP log-reception protocol. It affects FortiAnalyzer, and FortiManager with analyzer features enabled.
• CVE-2026-126260 (FG-IR-26-274), CVSS 9.0: pre-authentication SSRF over OFTP.
• CVE-2026-126170 (FG-IR-26-219), reported CVSS 9.8: JSON injection in the JSON-RPC API. Reported mitigation: set rpc-permit none where the API is not used.
• CVE-2026-126229 (FG-IR-26-244), CVSS 9.1: cross-VDOM access by an authenticated administrator.

FortiMail – five critical flaws:

• CVE-2026-126147 (FG-IR-26-199), CVSS 9.8: unauthenticated path traversal.
• CVE-2026-126148 (FG-IR-26-200), CVSS 9.8: unauthenticated command injection through HA join-request packets (8.0 and 7.6 only).
• CVE-2026-126164 (FG-IR-26-216), CVSS 9.4: unauthenticated SQL injection.
• CVE-2026-126155 and CVE-2026-126156: IBE webmail authorization bypasses leading to session access and account takeover.

Affected: 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and all of 7.2. Fixed: 8.0.2, 7.6.7, 7.4.9; 7.2 users must migrate. FortiMail Cloud was remediated on 5 October.

FortiAuthenticator: a hard-coded password (CVE-2026-126257, CVSS 9.0) and an authentication bypass (CVE-2026-126251, CVSS 9.1). Fixed in 8.0.4 and 6.6.11.

FortiOS / FortiSASE: an OSPF authentication bypass (CVE-2026-126253, CVSS 9.3), exploitable from an adjacent network only, plus high-severity SSH-daemon, kernel and WAD-proxy bugs. Fixed in FortiOS 8.0.2, 7.6.8, 7.4.13, 7.2.14.

Timeline

• 5 October 2026: FortiMail Cloud is remediated server-side.
• 10 November 2026: Fortinet publishes the November PSIRT batch.
• 11 November 2026: no advisory is marked exploited and none is listed in CISA KEV.

Tradecraft

No attacks have been reported yet, but the exposure model is familiar. FortiManager's FGFM service (TCP 541) and FortiAnalyzer's OFTP service are designed to accept connections from remote FortiGates. In many networks that means they are reachable from the internet or from large, flat branch networks. A pre-authentication bug in a central management server gives an attacker a path to push configuration or code to every managed firewall.

FortiMail sits at the email perimeter by design. An earlier 2026 FortiMail flaw was exploited within weeks of disclosure.

Some exploit databases already list entries for CVE-2026-126261. The ones reviewed only restate the advisory, and no working public exploit has been confirmed.

Detection

• Find out whether FGFM (TCP 541) and OFTP are reachable from untrusted networks:

nmap -Pn -p 541,514 <fortimanager-or-fortianalyzer-ip>

• On FortiManager, review the device list for unknown, unregistered or unexpected FortiGate serials. Check event logs for FGFM sessions from unfamiliar IP addresses.
• On FortiMail, look for unexpected HA join requests, new admin accounts, unfamiliar files in web-accessible paths, and IBE sessions you can't account for.
• Compare running configurations on managed FortiGates against your last known-good backup to catch unauthorised policy or script pushes.

Recommended Actions

1. Patch FortiManager, FortiAnalyzer and FortiMail first, then FortiAuthenticator and FortiOS. Use Fortinet's upgrade-path tool, and don't assume an October build covers every November fix.
2. Restrict FGFM (TCP 541) and OFTP to the IP ranges of your managed FortiGates only. Never expose management interfaces to the internet.
3. Where the JSON-RPC API is unused, apply set rpc-permit none. Disable FortiMail HA ports on untrusted interfaces.
4. Move FortiMail 7.2 to a supported branch. It will not receive these fixes.
5. After patching, rotate admin credentials and API tokens on central management systems and review logs back to at least early October.

Analyst Assessment

None of these bugs is known to be exploited yet. The combination of pre-authentication code paths in FortiManager and FortiMail, and Fortinet's track record of rapid n-day exploitation, makes this a Critical-priority patch cycle. FortiManager deserves particular attention. Compromising the central console hands an attacker the keys to the whole firewall estate, as earlier FortiManager exploitation showed. Expect researchers to diff the patches within days. Organisations that cannot patch this week should at least firewall FGFM and OFTP immediately.