{"id":4170,"date":"2026-11-11T07:09:13","date_gmt":"2026-11-11T15:09:13","guid":{"rendered":"https:\/\/cyber.mag212.com\/fortinet-ten-critical-advisories-fortimail-fortimanager-fgfm-fortios-ospf-migrate\/"},"modified":"2026-11-11T07:09:13","modified_gmt":"2026-11-11T15:09:13","slug":"fortinet-ten-critical-advisories-fortimail-fortimanager-fgfm-fortios-ospf-migrate","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/fortinet-ten-critical-advisories-fortimail-fortimanager-fgfm-fortios-ospf-migrate\/","title":{"rendered":"Fortinet\u2019s Ten Critical Advisories: Upgrade FortiMail, FortiManager and FortiOS, or Migrate Where No Fix Exists"},"content":{"rendered":"\n

Fortinet\u2019s PSIRT index jumped from 324 to 370 advisories on 10 November, and ten of the new entries are rated critical. The worst give unauthenticated attackers code execution on FortiMail and on FortiManager and FortiAnalyzer through the FGFM management port. None is known to be exploited yet, every advisory says there is no workaround, and several older branches get no fix at all: the only remedy there is migrating to a supported release.<\/p>\n\n\n\n

What happened<\/h2>\n\n\n\n

[Confirmed]<\/strong> The FortiGuard PSIRT index grew from 324 to 370 advisories on 10 November. Every advisory page our researchers fetched says “Known Exploited: No” and offers no workaround, so upgrading is the only fix. (FortiGuard<\/a>) (Fortinet RSS<\/a>) [Reported]<\/strong> The fixes came from Fortinet’s AI-assisted testing programme; watchTowr’s Yordan Ganchev expects them to be “rapidly reverse-engineered, reproduced, and exploited” and advises restricting exposed management interfaces. (Cybernews<\/a>)<\/p>\n\n\n\n

\"Matrix
Figure 5 \u00b7 Fortinet: where to upgrade, and where you must migrate.<\/strong> Fixed releases per branch from the advisories MAG212’s researchers fetched. Red cells have no fix in-branch. FortiAuthenticator versions were not retrieved. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n
Advisory<\/th>Product \u00b7 CVE<\/th>Flaw (Fortinet summary)<\/th>CVSS<\/th>Fixed<\/th><\/tr><\/thead>
FG-IR-26-199<\/a><\/td>FortiMail \u00b7 CVE-2026-126147<\/td>Unauth path traversal \u2192 code execution<\/td>9.8<\/td>8.0.2 \u00b7 7.6.7 \u00b7 7.4.9 \u00b7 7.2 migrate \u00b7 Cloud remediated<\/td><\/tr>
FG-IR-26-200<\/a><\/td>FortiMail \u00b7 CVE-2026-126148<\/td>Unauth command injection via HA join-request packets<\/td>9.8<\/td>8.0.2 \u00b7 7.6.7 \u00b7 7.4\/7.2 not affected<\/td><\/tr>
FG-IR-26-216<\/a><\/td>FortiMail \u00b7 CVE-2026-126164<\/td>Unauth SQL injection \u2192 code execution*<\/td>9.4<\/td>as -199; 7.2 migrate<\/td><\/tr>
-207<\/a> \/ -208<\/a><\/td>FortiMail IBE<\/td>Unauth IBE session \/ recipient account takeover<\/td>9.1<\/td>not retrieved<\/td><\/tr>
FG-IR-26-275<\/a><\/td>FortiManager & FortiAnalyzer FGFM \u00b7 CVE-2026-126261<\/td>Unauth code execution by anyone who can reach the FGFM port<\/td>9.0<\/td>8.0.1 \u00b7 7.6.8 \u00b7 7.4\/7.2 migrate<\/td><\/tr>
FG-IR-26-267<\/a><\/td>FortiOS, FortiSASE OSPF \u00b7 CVE-2026-126253<\/td>OSPF auth bypass; adjacent attacker may broadcast LSAs; PoC exists (E:P)<\/td>9.3<\/td>8.0.2 \u00b7 7.6.8 \u00b7 7.4.13 \u00b7 7.2.14; FortiSASE 26.3.2 (no action), 26.2\u201325.1 migrate<\/td><\/tr>
FG-IR-26-244<\/a><\/td>FortiManager\/FAZ (+Cloud) \u00b7 CVE-2026-126229<\/td>Authenticated<\/strong> admin reaches other VDOMs<\/td>9.1<\/td>not retrieved<\/td><\/tr>
FG-IR-26-271<\/a><\/td>FortiAuthenticator<\/td>Hard-coded password; credential bypass “in certain circumstances”<\/td>9.0<\/td>check the advisory<\/strong><\/td><\/tr>
FG-IR-26-265<\/a><\/td>FortiAuthenticator<\/td>Incorrect authorization; authentication bypass<\/td>9.1<\/td>check the advisory<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

*FG-IR-26-216’s Impact field says “Denial of service” while its summary describes code execution; treat it as the worse case. FortiAuthenticator advisories confirmed in Fortinet’s RSS feed; MAG212 has not retrieved their affected or fixed versions. Earlier social-post figures for FortiManager are superseded by FG-IR-26-275.<\/em><\/p>\n\n\n\n

Contain and remediate (in order)<\/h2>\n\n\n\n
    \n
  1. [MAG212 analysis]<\/strong> Start with FortiManager\/FortiAnalyzer reachable on FGFM<\/strong> from untrusted networks and internet-facing FortiMail<\/strong>: unauthenticated code execution, the class watchTowr expects to be weaponised.<\/li>\n\n\n
  2. Schedule migrations now<\/strong> for FortiMail 7.2 and FortiManager\/FortiAnalyzer 7.4\/7.2, which have no in-branch fix. (FG-IR-26-199<\/a>) (FG-IR-26-275<\/a>)<\/li>\n\n\n
  3. Upgrade FortiOS for the OSPF flaw. [MAG212 analysis]<\/strong> Meanwhile, OSPF authentication and passive interfaces on user segments reduce adjacency exposure (general hardening, not Fortinet guidance).<\/li>\n\n\n
  4. Read FG-IR-26-271 and -265 for FortiAuthenticator versions and patch; it sits in front of VPN and admin MFA.<\/li>\n\n\n
  5. Restrict all management interfaces to trusted networks. (Cybernews<\/a>)<\/li>\n\n<\/ol>\n\n\n\n

    Look for and verify:<\/strong> [MAG212 analysis]<\/strong> no IOCs exist; watch FGFM and FortiMail HA traffic from unexpected sources and OSPF neighbour changes you didn’t make. Confirm firmware per device and, from outside, that FGFM and FortiMail admin\/HA ports don’t answer.<\/p>\n\n\n\n

    Why it matters<\/h2>\n\n\n\n

    Fortinet management and mail products have a long history of rapid weaponisation once patches are public, and researchers expect these to be reverse-engineered quickly. FortiManager in particular controls the configuration of every FortiGate it manages, so one exposed FGFM port can become an estate-wide compromise.<\/p>\n\n\n\n

    The bottom line<\/h2>\n\n\n\n

    Start with FortiManager and FortiAnalyzer reachable on FGFM and internet-facing FortiMail, schedule migrations for branches with no in-branch fix, upgrade FortiOS for the OSPF flaw, read the FortiAuthenticator advisories, and make sure no management interface answers from the internet.<\/p>\n\n\n\n

    How we label evidence: [Confirmed]<\/strong> comes from a primary source such as a vendor or CISA; [Reported]<\/strong> from a secondary outlet; [Claimed]<\/strong> from an attacker or an unverified party; [MAG212 analysis]<\/strong> is our judgement; [Unknown]<\/strong> means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.<\/em><\/p>\n\n\n\n

    \n\n\n\n

    This story is part of MAG212 CYBER Daily, 11 November 2026<\/a>, with the day\u2019s other verified stories, the Defender\u2019s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER<\/a>. By El Mostafa Ouchen.<\/p>\n\n","protected":false},"excerpt":{"rendered":"

    Fortinet published ten critical advisories on 10 November, including unauthenticated code execution in FortiMail and FortiManager\u2019s FGFM service and an OSPF bypass with a public proof of concept. None is exploited yet and there are no workarounds. Fixed versions, branches that must migrate and the order to act.<\/p>","protected":false},"author":1,"featured_media":4168,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,14],"tags":[315,312,313,311,314,28],"class_list":["post-4170","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-vulnerabilities","tag-fortiauthenticator","tag-fortimail","tag-fortimanager","tag-fortinet","tag-fortios","tag-network-security"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4170","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4170"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4170\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4168"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4170"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4170"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4170"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}