Fortinet has disclosed a critical security flaw in its FortiManager and FortiAnalyzer products that could let an attacker run code or commands without logging in. The vulnerability, tracked as CVE-2026-126170 and rated 9.8 out of 10, was published on 10 November 2026 as part of a wider set of Fortinet security disclosures.

The flaw is a JSON injection weakness in the JSON-RPC API shared by FortiManager and FortiAnalyzer. When the JSON API is enabled, specially crafted requests could allow an unauthenticated attacker to execute code or commands on the affected system. The issue is tracked by Fortinet as FG-IR-26-219. Fortinet says organisations that use the API for automation should review their exposure closely.

Why this flaw matters

FortiManager and FortiAnalyzer occupy privileged positions inside enterprise networks. FortiManager centrally manages fleets of Fortinet firewalls and other devices, while FortiAnalyzer collects and analyses security events. A compromise of either system could give an attacker control over managed devices across an organisation, or a way to interfere with the security monitoring that would otherwise spot an intrusion.

The disclosures cover more than one product. Alongside CVE-2026-126170, Fortinet published CVE-2026-126261, rated 9.0, an authorisation weakness in FortiManager's FGFM device-management service that can be exploited before the registration password is checked. It affects FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5 and 7.2.0 through 7.2.8, with fixed releases 8.0.1, 7.6.8, 7.4.6 and 7.2.9. The FGFM service runs on TCP port 541.

Two further critical flaws affect the OFTP log-transfer service on TCP port 514: CVE-2026-126262, rated 9.3, an unauthenticated SQL injection flaw, and CVE-2026-126260, rated 9.0, a pre-authentication server-side request forgery flaw. Both affect FortiAnalyzer and FortiManager systems with FortiAnalyzer features enabled. The release also includes routing flaws in FortiOS, including a 9.6-rated numeric truncation issue in BGP handling and a 9.3-rated OSPF authentication bypass, plus a 9.0-rated command execution flaw in specific FGSP synchronisation setups.

Fixes shipped before the details

Fortinet shipped the security updates in October, before publishing the detailed advisories on 10 November, to give customers time to upgrade. The flaws were found through Fortinet's own security hardening programme, which uses AI-assisted testing. For CVE-2026-126170, the 8.0 branch needs particular attention because the fixed release 8.0.3 was listed as forthcoming at publication time, so administrators should check the current advisory before planning an upgrade.

As a temporary mitigation, Fortinet advises disabling unused JSON API access with the command set rpc-permit none. Administrators should also restrict access to TCP ports 541 and 514 to trusted management systems only, and should not assume that protecting the browser login page is enough, since these services run independently of the web interface. Configuration backups should be taken before any firmware upgrade.

No exploitation reported at publication

Fortinet had no known exploitation of these flaws at the time of publication, and Australia's Cyber Security Centre said it was not aware of active exploitation in Australia. That picture can change quickly once technical details are public, so the advice is to patch exposed management systems now rather than wait for reports of attacks. Organisations should also review logs for suspicious management activity, unexpected configuration changes and unusual connections involving TCP ports 541 and 514.