Fortinet published PSIRT advisories on 10 November 2026, the date it gave in October for advisories covering its hardening releases. This is a new post on those advisories, not an update of our earlier October hardening-release note.
The items below were checked against Fortinet's PSIRT pages and CSAF files. This post leads with unauthenticated FortiMail issues that Fortinet rates Critical and says can allow code or command execution, and with an unauthenticated FortiManager FGFM flaw that Fortinet also rates Critical. Fortinet lists Known Exploited: No on each advisory reviewed here. None of these CVE IDs were in CISA's Known Exploited Vulnerabilities catalog as of catalogVersion 2026.11.10, checked 11 November 2026 at 09:20 Asia/Jerusalem UTC+2. This post makes no exploitation claim.
Technical Information
FortiMail, unauthenticated. FG-IR-26-199 (CVE-2026-126147) is a path-traversal issue (CWE-22). Fortinet says it "may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests." Fortinet rates it Critical, CVSS 3.1 9.8 (AV:N/PR:N).
FG-IR-26-200 (CVE-2026-126148) is a command-injection issue that Fortinet says may allow an unauthenticated attacker to execute unauthorized code or commands "via crafted HA join-request packets." Fortinet rates it Critical, CVSS 3.1 9.8. The advisory page cites CWE-77; the CSAF file lists CWE-78. FortiMail 7.4 and 7.2 are not affected.
FG-IR-26-216 (CVE-2026-126164) is an SQL-injection issue (CWE-89). Fortinet's summary says an unauthenticated attacker may "execute unauthorized code or commands via crafted requests"; the advisory's Impact field and the CSAF threat entry say "Denial of service." Fortinet rates it Critical, CVSS 3.1 9.4.
FortiManager FGFM. FG-IR-26-275 (CVE-2026-126261) is an improper-authorization issue (CSAF and the CVE record list CWE-285). Fortinet says it "may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets." Fortinet rates it Critical, CVSS 3.1 9.0 (AV:N/PR:N); NVD, which has received the record, shows a Fortinet-sourced 9.8 for the same base vector; this post uses the 9.0 on Fortinet's advisory. The FGFM fixed releases (8.0.1, 7.6.8, 7.4.6, 7.2.9) differ from the FortiManager floors on FG-IR-26-244 below; track each advisory separately.
FortiOS and FortiSASE OSPF (adjacent network only). FG-IR-26-267 (CVE-2026-126253) is an authentication bypass by primary weakness (CWE-305) in the OSPF daemon. Fortinet says an unauthenticated attacker may "broadcast LSA via specially crafted request." Fortinet rates it Critical, CVSS 3.1 9.3, with vector AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H. AV:A means the attacker needs adjacent-network access; Fortinet does not describe a remote internet path. The CSAF remediation lists only FortiOS; the FortiSASE rows are on the advisory page.
FortiMail IBE. FG-IR-26-207 (CVE-2026-126155) is an incorrect-authorization issue (CWE-863). Fortinet says an unauthenticated remote attacker may "obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests"; the Impact field and CSAF say "Denial of service." FG-IR-26-208 (CVE-2026-126156) is an authorization bypass through a user-controlled key (CWE-639) that Fortinet says may let an unauthenticated remote attacker "take over an arbitrary IBE recipient account via crafted HTTP requests." Fortinet rates both Critical, CVSS 3.1 9.1.
FortiAuthenticator. FG-IR-26-271 (CVE-2026-126257) is a hard-coded password issue (CWE-259) that Fortinet says may allow an unauthenticated attacker to "bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access." Fortinet rates it Critical, CVSS 3.1 9.0, with AC:H. FG-IR-26-265 (CVE-2026-126251) is an incorrect-authorization issue (CWE-863) that "may allow an attacker to bypass authentication and gain unauthorized access"; Fortinet rates it Critical, CVSS 3.1 9.1.
FortiManager and FortiAnalyzer, authenticated. FG-IR-26-244 (CVE-2026-126229) is an authorization bypass through a user-controlled key (CWE-639) in dmserver that Fortinet says could allow an authenticated administrator to access other VDOMs via crafted HTTP requests. Fortinet rates it Critical, CVSS 3.1 9.1 (PR:H), covering FortiManager, FortiAnalyzer and their Cloud variants.
FortiOS issues Fortinet rates High. FG-IR-26-269 (CVE-2026-126255) is a path-traversal issue (CWE-24) in the SSH daemon of FortiOS, FortiSASE, FortiProxy and FortiPAM; Fortinet says an unauthenticated attacker may "bypass authentication via specially crafted credentials," and that "the product is impacted only if GPC OS Login is enabled." Fortinet rates it High, CVSS 3.1 7.4; its Impact field says "Denial of service." The fix table names FortiOS, FortiPAM and FortiSASE but not FortiProxy, so this post lists no FortiProxy versions.
FG-IR-26-270 (CVE-2026-126256) is a kernel out-of-bounds read/write issue. Fortinet's summary says it "may allow a remote privileged attacker to execute arbitrary code or command"; the same page lists Attack Type Unauthenticated and the CSAF vector has PR:N. Fortinet rates it High, CVSS 3.1 7.4. CSAF also names FortiSwitchManager without fixed versions, so none are listed here.
FG-IR-26-272 (CVE-2026-126258) is a stack-based buffer overflow (CWE-121) in the FortiOS WAD proxy. Fortinet says an unauthenticated attacker with WAD port access may "crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests"; the Impact field says "Execute unauthorized code or commands." Fortinet rates it High, CVSS 3.1 7.1. The advisory page gives 7.6.8 as the fix for 7.6.7; the CSAF file says "upcoming 7.6.8."
Affected Product Versions
From Fortinet's advisory tables, cross-checked with CSAF.
| Advisory | Product | Affected | Fix |
|---|---|---|---|
| FG-IR-26-199 / 216 / 207 / 208 | FortiMail | 8.0.0–8.0.1; 7.6.0–7.6.6; 7.4.0–7.4.8; 7.2 all versions | 8.0.2; 7.6.7; 7.4.9; 7.2 migrate to a fixed release |
| FG-IR-26-200 | FortiMail | 8.0.0–8.0.1; 7.6.0–7.6.6; 7.4 and 7.2 not affected | 8.0.2; 7.6.7 |
| FG-IR-26-275 | FortiManager | 8.0.0; 7.6.0–7.6.7; 7.4.0–7.4.5; 7.2.0–7.2.8 | 8.0.1; 7.6.8; 7.4.6; 7.2.9 |
| FG-IR-26-244 | FortiManager, FortiAnalyzer and Cloud variants | 8.0.0–8.0.1 (Cloud 8.0.1); 7.6.0–7.6.7; 7.4.0–7.4.11 (Cloud 7.4.1–7.4.11); 7.2 all versions | 8.0.2; 7.6.8; 7.4.12; 7.2 migrate to a fixed release |
| FG-IR-26-271 / 265 | FortiAuthenticator | 8.0.0–8.0.3; 6.6.0–6.6.10 | 8.0.4; 6.6.11 |
| FG-IR-26-267 / 269 / 270 | FortiOS | 8.0.0–8.0.1; 7.6.0–7.6.7; 7.4.0–7.4.12; 7.2.0–7.2.13 | 8.0.2; 7.6.8; 7.4.13; 7.2.14 |
| FG-IR-26-272 | FortiOS | 8.0.0; 7.6.7; 7.4 and 7.2 not affected | 8.0.1; 7.6.8 |
On FG-IR-26-267, 269 and 270, Fortinet says FortiSASE 26.3.1 and 26.3.1_a were remediated in 26.3.2 with no customer action needed, and the listed 26.2 through 25.1 branches should migrate. FortiSASE 24.4 and earlier are not affected by 267 and 269 but are listed as affected by 270, with migration advised. On 269, FortiPAM 1.7 and later are not affected; 1.6 and earlier should migrate. On the FortiMail advisories, Fortinet says it remediated FortiMail Cloud on 5 October 2026 and Cloud customers need not act.
Exploitation Status
Fortinet marks each advisory Known Exploited: No, and none of these CVE IDs were in the CISA catalog at the check above. FG-IR-26-270 lists an IPS virtual patch named FG-VD-62355.0day.; that name is not evidence of exploitation.
Workaround and Mitigation
Fortinet's remediation is to upgrade to the fixed releases above, using its upgrade-path tool. The vendor-stated exceptions are the FortiMail Cloud and FortiSASE 26.3.2 remediations noted above. On FG-IR-26-270 only, Fortinet lists the IPS virtual patch in FMWP db update 26.100; it does not replace the FortiOS upgrade.
Indicators of Compromise
Fortinet's advisories publish no indicators of compromise for these CVEs, and this post does not supply any.
What to Ask Your MSSPs and Mail Security Providers Today
Many organizations rely on MSPs and MSSPs that manage their FortiGates through FortiManager, and on providers that run FortiMail or FortiAuthenticator for them. Ask those suppliers, in writing:
- Which FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator and FortiOS versions serve your environment, including Cloud instances.
- Whether the fixed releases have been applied and when, with FGFM (FG-IR-26-275) tracked against its own floors rather than those on FG-IR-26-244.
- Whether the FGFM port and the FortiMail and IBE interfaces are reachable beyond their intended networks, and which networks are OSPF-adjacent to your FortiGates.
- Whether FortiMail Cloud and FortiSASE tenancies are covered by Fortinet's "no customer action" statements.
- Whether they checked the GPC OS Login condition on FG-IR-26-269.
If you operate these products yourself, apply Fortinet's fixed release for each advisory first, then confirm the same points against your inventory.
If your team needs help reviewing exposure against these advisories, Talk to an expert.
Sources
- Fortinet PSIRT, FortiMail: FG-IR-26-199, FG-IR-26-200, FG-IR-26-216, FG-IR-26-207, FG-IR-26-208.
- Fortinet PSIRT, FortiManager and FortiAnalyzer: FG-IR-26-275, FG-IR-26-244.
- Fortinet PSIRT, FortiAuthenticator: FG-IR-26-271, FG-IR-26-265.
- Fortinet PSIRT, FortiOS and FortiSASE: FG-IR-26-267, FG-IR-26-269, FG-IR-26-270, FG-IR-26-272. Advisory pages and CSAF checked 11 November 2026 at 09:19 Asia/Jerusalem UTC+2.
- NVD CVE-2026-126261 — status Received; the other CVE IDs had no NVD record at the 09:20 check.
- CISA Known Exploited Vulnerabilities catalog JSON — catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29Z; none of these CVE IDs listed as of 11 November 2026 at 09:20 Asia/Jerusalem UTC+2.
- October hardening-release note — related Rescana post.
