Fortinet's November advisories: unauthenticated FortiMail RCEs (CVSS 9.8) and a FortiManager FGFM code-execution bug, many found internally with Claude Mythos
- FortiMail: upgrade to 8.0.2, 7.6.7 or 7.4.9 (7.2 must migrate). Also critical: unauthenticated IBE account takeover / session as any IBE recipient (FG-IR-26-207, -208, 9.1) and SQL injection (FG-IR-26-216, 9.4). FortiMail Cloud was fixed Oct 5.
- FortiManager / FortiAnalyzer FGFM (FG-IR-26-275): fixed in 8.0.1 and 7.6.8; 7.4 and 7.2 have no fix and must migrate. FGFM was the vector for 2024's exploited FortiJump, so keep TCP 541 reachable only from managed devices.
- FortiOS/FortiSASE: OSPF authentication bypass FG-IR-26-267 (9.3, crafted LSAs) fixed in 8.0.2, 7.6.8, 7.4.13, 7.2.14.
- FortiAuthenticator: hard-coded password auth bypass FG-IR-26-271 (9.0) and incorrect authorization FG-IR-26-265 (9.1).
- Dozens more authenticated FortiManager/FortiAnalyzer command injection, SQLi and path traversal bugs; plan a full upgrade rather than cherry-picking.
Sources: FortiGuard PSIRT FG-IR-26-199 (CVE-2026-126147) · FortiGuard PSIRT FG-IR-26-200 (CVE-2026-126148) · FortiGuard PSIRT FG-IR-26-275 (CVE-2026-126261) · FortiGuard PSIRT FG-IR-26-267 · FortiGuard PSIRT advisories RSS