---
title: Fortinet's November advisories: unauthenticated FortiMail RCEs (CVSS 9.8) and a FortiManager FGFM code-execution bug, many found internally with Claude Mythos | ctxsec
url: https://ctxsec.com/items/fortinet-nov-2026-psirt-fortimail-unauth-rce-fortimanager-fgfm-ai-found
description: "Fortinet published a large batch of PSIRT advisories on Nov 10, dominated by FortiMail, FortiManager/FortiAnalyzer and FortiAuthenticator. The ones to move first are unauthenticated: FortiMail path traversal to code execution CVE-2026-126147 (FG-IR-26-199, 9.8) and HA join-request command injection CVE-2026-126148 (FG-IR-26-200, 9.8), and FortiManager/FortiAnalyzer FGFM improper authorization CVE-2026-126261 (FG-IR-26-275, 9.0), which lets anyone who can reach the FGFM port run code. Fortinet says none are known exploited, and credits its own product security team, in many cases 'with the use of the frontier AI model: Claude Mythos'."
status: "official (Fortinet PSIRT advisories, Nov 10, 2026; Fortinet marks all as Known Exploited: No)"
published: 2026-11-10
---

> Fortinet published a large batch of PSIRT advisories on Nov 10, dominated by FortiMail, FortiManager/FortiAnalyzer and FortiAuthenticator. The ones to move first are unauthenticated: FortiMail path traversal to code execution CVE-2026-126147 (FG-IR-26-199, 9.8) and HA join-request command injection CVE-2026-126148 (FG-IR-26-200, 9.8), and FortiManager/FortiAnalyzer FGFM improper authorization CVE-2026-126261 (FG-IR-26-275, 9.0), which lets anyone who can reach the FGFM port run code. Fortinet says none are known exploited, and credits its own product security team, in many cases 'with the use of the frontier AI model: Claude Mythos'.

[← Cybersecurity News](/news) · [markdown](/items/fortinet-nov-2026-psirt-fortimail-unauth-rce-fortimanager-fgfm-ai-found.md)

official (Fortinet PSIRT advisories, Nov 10, 2026; Fortinet marks all as Known Exploited: No)

2026-11-10

### Fortinet's November advisories: unauthenticated FortiMail RCEs (CVSS 9.8) and a FortiManager FGFM code-execution bug, many found internally with Claude Mythos

- **FortiMail:** upgrade to 8.0.2, 7.6.7 or 7.4.9 (7.2 must migrate). Also critical: unauthenticated IBE account takeover / session as any IBE recipient (FG-IR-26-207, -208, 9.1) and SQL injection (FG-IR-26-216, 9.4). FortiMail Cloud was fixed Oct 5.
- **FortiManager / FortiAnalyzer FGFM (FG-IR-26-275):** fixed in 8.0.1 and 7.6.8; **7.4 and 7.2 have no fix and must migrate**. FGFM was the vector for 2024's exploited FortiJump, so keep TCP 541 reachable only from managed devices.
- **FortiOS/FortiSASE:** OSPF authentication bypass FG-IR-26-267 (9.3, crafted LSAs) fixed in 8.0.2, 7.6.8, 7.4.13, 7.2.14.
- **FortiAuthenticator:** hard-coded password auth bypass FG-IR-26-271 (9.0) and incorrect authorization FG-IR-26-265 (9.1).
- Dozens more authenticated FortiManager/FortiAnalyzer command injection, SQLi and path traversal bugs; plan a full upgrade rather than cherry-picking.

Sources: [FortiGuard PSIRT FG-IR-26-199 (CVE-2026-126147)](https://fortiguard.fortinet.com/psirt/FG-IR-26-199) · [FortiGuard PSIRT FG-IR-26-200 (CVE-2026-126148)](https://fortiguard.fortinet.com/psirt/FG-IR-26-200) · [FortiGuard PSIRT FG-IR-26-275 (CVE-2026-126261)](https://fortiguard.fortinet.com/psirt/FG-IR-26-275) · [FortiGuard PSIRT FG-IR-26-267](https://fortiguard.fortinet.com/psirt/FG-IR-26-267) · [FortiGuard PSIRT advisories RSS](https://filestore.fortinet.com/fortiguard/rss/ir.xml)