Fortinet patches dozens of FortiOS, FortiManager flaws
CERT-FR details over 70 Fortinet vulnerabilities across FortiOS, FortiManager, FortiAnalyzer, FortiSandbox, FortiPAM and FortiSASE enabling RCE, privilege escalation and data exposure.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has issued an advisory consolidating more than 70 Fortinet security bulletins (FG-IR-26-xxx series) published on 10 November 2026, covering a wide range of Fortinet products including FortiOS, FortiManager, FortiManager Cloud, FortiAnalyzer, FortiAnalyzer Cloud, FortiSandbox, FortiSandbox Cloud/PaaS, FortiPAM and FortiSASE. The vulnerabilities span multiple risk categories: remote code execution, privilege escalation, SSRF, SQL injection, stored/reflected XSS, denial of service, and unauthorized data disclosure or integrity compromise.
Affected version ranges are extensive — essentially all FortiOS 7.2/7.4/7.6/8.0 branches prior to the latest point releases, all FortiManager and FortiAnalyzer 7.2–8.0 branches, all FortiPAM 1.x versions, and all FortiSASE versions are listed as vulnerable to at least one of the referenced issues. FortiSandbox is affected up to 5.0.6 and 4.4.9. No public exploitation or proof-of-concept activity is mentioned in the advisory; CERT-FR's guidance is limited to directing administrators to Fortinet's own PSIRT bulletins for patch details and fixed versions.
Given the scale of the product line affected — core perimeter and management infrastructure (FortiOS, FortiManager, FortiAnalyzer) — and the presence of remote code execution and privilege escalation among the disclosed classes, organizations running Fortinet appliances should prioritize patching to the fixed versions identified per product (e.g., FortiOS 7.2.14/7.4.13/7.6.8/8.0.2, FortiManager 7.2.13/7.4.12/7.6.8/8.0.2, FortiAnalyzer equivalents) as soon as feasible, and review FortiGuard PSIRT entries for applicability of each CVE to their deployed modules and configurations.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1499
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs