# Fortinet patches dozens of FortiOS, FortiManager flaws

Published: 2026-11-12 · Severity: routine · Sectors: Technology, Telecommunications, Government (National), Financial Services
Canonical: https://vorant.io/reports/8123d5f8-6eb6-5ecf-9a3f-381bee8b848e/fortinet-patches-dozens-of-fortios-fortimanager-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR details over 70 Fortinet vulnerabilities across FortiOS, FortiManager, FortiAnalyzer, FortiSandbox, FortiPAM and FortiSASE enabling RCE, privilege escalation and data exposure.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1499

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR has issued an advisory consolidating more than 70 Fortinet security bulletins (FG-IR-26-xxx series) published on 10 November 2026, covering a wide range of Fortinet products including FortiOS, FortiManager, FortiManager Cloud, FortiAnalyzer, FortiAnalyzer Cloud, FortiSandbox, FortiSandbox Cloud/PaaS, FortiPAM and FortiSASE. The vulnerabilities span multiple risk categories: remote code execution, privilege escalation, SSRF, SQL injection, stored/reflected XSS, denial of service, and unauthorized data disclosure or integrity compromise.

Affected version ranges are extensive — essentially all FortiOS 7.2/7.4/7.6/8.0 branches prior to the latest point releases, all FortiManager and FortiAnalyzer 7.2–8.0 branches, all FortiPAM 1.x versions, and all FortiSASE versions are listed as vulnerable to at least one of the referenced issues. FortiSandbox is affected up to 5.0.6 and 4.4.9. No public exploitation or proof-of-concept activity is mentioned in the advisory; CERT-FR's guidance is limited to directing administrators to Fortinet's own PSIRT bulletins for patch details and fixed versions.

Given the scale of the product line affected — core perimeter and management infrastructure (FortiOS, FortiManager, FortiAnalyzer) — and the presence of remote code execution and privilege escalation among the disclosed classes, organizations running Fortinet appliances should prioritize patching to the fixed versions identified per product (e.g., FortiOS 7.2.14/7.4.13/7.6.8/8.0.2, FortiManager 7.2.13/7.4.12/7.6.8/8.0.2, FortiAnalyzer equivalents) as soon as feasible, and review FortiGuard PSIRT entries for applicability of each CVE to their deployed modules and configurations.

## Mentioned in this report

- Vulnerabilities: CVE-2025-61625, CVE-2026-121528, CVE-2026-121530, CVE-2026-126170, CVE-2026-126171, CVE-2026-126175, CVE-2026-126176, CVE-2026-126177, CVE-2026-126178, CVE-2026-126179, CVE-2026-126180, CVE-2026-126181, CVE-2026-126182, CVE-2026-126183, CVE-2026-126184, CVE-2026-126185, CVE-2026-126211, CVE-2026-126212, CVE-2026-126213, CVE-2026-126214, CVE-2026-126215, CVE-2026-126216, CVE-2026-126217, CVE-2026-126218, CVE-2026-126219, CVE-2026-126220, CVE-2026-126221, CVE-2026-126222, CVE-2026-126223, CVE-2026-126224, CVE-2026-126225, CVE-2026-126226, CVE-2026-126227, CVE-2026-126228, CVE-2026-126229, CVE-2026-126230, CVE-2026-126231, CVE-2026-126232, CVE-2026-126233, CVE-2026-126234

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1499

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8123d5f8-6eb6-5ecf-9a3f-381bee8b848e/fortinet-patches-dozens-of-fortios-fortimanager-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup