Critical Fortinet Flaws Allow Unauthenticated Remote Code Execution on FortiManager and FortiAnalyzer

Fortinet has issued urgent security advisories detailing several critical vulnerabilities affecting its FortiManager and FortiAnalyzer network management and analysis platforms, as well as the underlying FortiOS. These flaws, some carrying CVSS scores as high as 9.8, permit unauthenticated attackers to execute arbitrary code on vulnerable systems, posing a significant risk to organizations relying on these devices for network oversight and security.

The most severe vulnerability, CVE-2026-126170 (FG-IR-26-219), is a JSON injection flaw within the JSON-RPC API used by FortiManager and FortiAnalyzer. When this API is enabled, attackers can send specially crafted requests to achieve remote code execution without requiring any form of authentication. This makes any Fortinet deployment with the JSON API enabled a prime target for exploitation.

Further compounding the risk, CVE-2026-126261 (FG-IR-26-275), rated CVSS 9.0, affects FortiManager's FGFM service. This authorization weakness allows attackers who can reach the FGFM port (TCP 541) to execute code before the device even attempts to verify its registration password. Similarly, CVE-2026-126262 (FG-IR-26-276), a critical SQL injection vulnerability with a CVSS score of 9.3, impacts FortiAnalyzer and FortiManager systems with FortiAnalyzer features enabled. Exploitation of this flaw through the OFTP service (TCP 514) can also lead to code execution without prior authentication.

Beyond these critical remote code execution flaws, Fortinet also addressed other significant vulnerabilities. CVE-2026-126260 (FG-IR-26-274), a 9.0-rated Server-Side Request Forgery (SSRF) flaw in the OFTP service, allows attackers to force vulnerable servers to make arbitrary requests. Additionally, several FortiOS vulnerabilities were patched, including a high-severity numeric truncation flaw in BGP handling (CVE-2026-126254), an OSPF authentication bypass (CVE-2026-126253), and an authorization bypass allowing authenticated administrators to access unintended VDOMs (CVE-2026-126229).

Fortinet has released patches for these vulnerabilities, urging customers to update their systems promptly. The affected versions for CVE-2026-126261, for instance, include FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8, with fixes available in 8.0.1, 7.6.8, 7.4.6, and 7.2.9 respectively. Administrators are advised to consult Fortinet's advisories for specific version information and recommended upgrade paths.

These vulnerabilities underscore the critical importance of securing management interfaces and services, as they often present the most direct path to compromising an entire network infrastructure. The fact that several of these critical flaws allow for unauthenticated remote code execution means that even externally facing management appliances are at risk if not properly secured and patched. Organizations should prioritize patching these vulnerabilities and review their network access controls for management services.

While Fortinet states that CVE-2026-126261 is not known to have been exploited in the wild at the time of disclosure, the severity and unauthenticated nature of these flaws make them highly attractive targets for threat actors. Proactive patching and diligent security hygiene are essential to mitigate the risk of widespread compromise.