Fortinet November 2026 critical flaws affect FortiManager, FortiAnalyzer, and related deployments through two different exposed services. Fortinet published CVE-2026-126170, CVE-2026-126260, and CVE-2026-126262 on November 10, 2026.
All three advisories say the vulnerabilities were not known to be exploited when published. Defenders should still distinguish OFTP-reachable systems from deployments where the optional JSON API is enabled.
The advisories provide CVSS 3 scores but no CVSS 4.0 scores. They do not identify whether the CVSS 3 calculation uses version 3.0 or 3.1.
- CVE-2026-126262.
- SQL injection through reachable OFTP; CVSS 9.3.
- CVE-2026-126170.
- Output-encoding flaw when the JSON API is enabled; CVSS 9.8.
- CVE-2026-126260.
- Server-side request forgery through reachable OFTP; CVSS 9.0.
- Known exploitation.
- Fortinet marked all three No on November 10, 2026.
Fortinet November 2026 Critical Flaws: Patch Order
Start with CVE-2026-126262 on systems whose OFTP service is reachable. Fortinet says an unauthenticated attacker with OFTP access may execute unauthorized code or commands through crafted traffic.
CVE-2026-126260 also requires OFTP reachability. Its published impact is server-side request execution, not the same SQL injection and code-execution path described for CVE-2026-126262.
Then identify systems with the JSON API enabled for CVE-2026-126170. Fortinet says the feature is disabled by default, making configuration a decisive exposure condition.
| CVE | Exposure prerequisite | Fortinet impact | Patch priority |
|---|---|---|---|
| CVE-2026-126262 | Unauthenticated access to OFTP | SQL injection may enable unauthorized code or command execution | First on OFTP-reachable systems |
| CVE-2026-126260 | Access to OFTP | Server-side request forgery may enable server-side requests | Patch alongside CVE-2026-126262 |
| CVE-2026-126170 | JSON API enabled on an affected profile | Unauthorized code or command execution; advisory impact field says denial of service | Immediately validate configuration, then patch exposed systems |
The CVE-2026-126170 advisory contains two impact descriptions. Its summary describes unauthorized code or command execution, while its metadata lists denial of service. Teams should retain both statements until Fortinet clarifies them.
CVE-2026-126262 Fixes for FortiAnalyzer and FortiManager
CVE-2026-126262 is a critical SQL injection flaw with a CVSS 3 score of 9.3. It affects FortiAnalyzer and FortiManager installations using FortiAnalyzer features when an attacker can reach OFTP.
FortiAnalyzer 8.0.0 through 8.0.1 must move to 8.0.2 or later. FortiManager 8.0.0 must move to 8.0.1 or later.
For both products, 7.6.0 through 7.6.7 require 7.6.8 or later. Versions 7.4.0 through 7.4.11 require 7.4.12, while 7.2.0 through 7.2.12 require 7.2.13.
CVE-2026-126260 OFTP SSRF Fixes
CVE-2026-126260 is a critical server-side request forgery flaw scored 9.0. It affects FortiAnalyzer and FortiManager with FortiAnalyzer features when OFTP is reachable.
FortiAnalyzer and FortiManager 8.0.0 require 8.0.1 or later. For both products, 7.6.0 through 7.6.7 require 7.6.8, and 7.4.0 through 7.4.11 require 7.4.12.
Fortinet marks the 7.2 branches of both products as unaffected. This differs from CVE-2026-126262, where affected 7.2 releases require 7.2.13.
CVE-2026-126170 Depends on JSON API Exposure
CVE-2026-126170 is an improper output-encoding flaw scored 9.8. It affects selected 8.0 and 7.6 releases of FortiAnalyzer, FortiManager, their cloud variants, and FortiAnalyzer BigData.
FortiAnalyzer and FortiManager 7.6.0 through 7.6.7 require 7.6.8. Their affected 8.0 releases require the upcoming 8.0.3 or later, or Fortinet’s workaround until that release is available.
FortiAnalyzer Cloud and FortiManager Cloud follow the same 7.6 and 8.0 destination versions. FortiAnalyzer BigData 7.6.0 through 7.6.2 requires the upcoming 7.6.3 or the workaround.
The advisory marks the listed 7.4 and 7.2 branches as unaffected. It directs customers on older FortiSASE Sovereign branches to migrate to a fixed release.
What Fortinet Administrators Should Check
- Inventory FortiManager, FortiAnalyzer, cloud, BigData, and Sovereign deployments.
- Identify which systems expose OFTP to untrusted networks.
- Confirm whether the JSON API is enabled on any administrative profile.
- Apply the fixed release for each product branch.
- Use Fortinet’s documented workaround where the target release remains upcoming.
- Review preserved service and administrative logs for unexpected activity.
- Verify service reachability and intended configuration after maintenance.
This ordering is our defensive prioritization based on reachability, authentication, and published impact. A documented vulnerability management process can connect each appliance, service exposure, fix, and verification result.
Use the organization's risk model to separate a published vulnerability from actual exposure. Our threat, vulnerability, and risk explainer shows why those terms are not interchangeable.
Do not use a successful upgrade as evidence that earlier compromise did not occur. If logs show suspicious activity, preserve the evidence and follow the organization’s incident response plan.
Frequently Asked Questions
Which Fortinet November 2026 critical flaw should be patched first?
Prioritize CVE-2026-126262 on OFTP-reachable systems. It is unauthenticated SQL injection that Fortinet says may enable unauthorized code or command execution.
Is CVE-2026-126170 exposed by default?
Fortinet says the flaw exists only when the JSON API is enabled. The API is disabled by default, so administrators must verify each profile's configuration.
Are the three Fortinet vulnerabilities actively exploited?
Fortinet marked known exploitation as No for all three advisories when they were published on November 10, 2026.
Which Fortinet products are affected?
The advisories cover FortiAnalyzer, FortiManager, their cloud variants, FortiAnalyzer BigData, and selected FortiSASE Sovereign releases. Product coverage differs by CVE.
