Fortinet fixes 18 critical bugs in FortiOS, FortiMail and FortiClient. Upgrade clustered FortiGates first

Fortinet published 89 security advisories on Tuesday, covering close to 100 vulnerabilities across FortiOS, FortiMail, FortiAuthenticator, FortiManager, FortiAnalyzer and FortiClient. None is known to be exploited yet.

That “yet” is the reason to move this week. Fortinet gear has been a favorite target for years, and Fortinet itself says it is publishing early because AI is shortening the gap between disclosure and attack.

Fortinet fixed 18 critical bugs on Tuesday, including one that runs commands as super admin on clustered FortiGates. None are exploited yet. Patch before that changes.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Fortinet fixes 18 critical bugs in one release

OpenAdvisories counts 98 CVEs in the November 10 release: 18 critical and 76 high. SecurityWeek reports that the drop comes three weeks after Fortinet said it had added frontier AI models to its product security testing, and several advisories credit Fortinet’s own team working with an AI model.

The ones that matter most for a typical network team:

• FortiOS, CVE-2026-126259 (9.0): an unauthenticated attacker can run commands as super admin with crafted HA packets on firewalls using FGSP with standalone-config-sync, or autoscale. Fixed in 8.0.1, 7.6.8, 7.4.13 and 7.2.14. A virtual patch is in FortiManager’s FMWP database update 26.082.
• FortiOS, CVE-2026-126253 (9.3): an OSPF authentication bypass lets an attacker on the adjacent network inject routing updates. Fixed in 8.0.2, 7.6.8, 7.4.13 and 7.2.14.
• FortiMail, CVE-2026-126147 (9.8): unauthenticated path traversal to code execution. Fixed in 8.0.2, 7.6.7 and 7.4.9; 7.2 has no fix and must move to a newer branch. FortiMail Cloud was patched on October 5.
• FortiClient, CVE-2026-121529 (9.1): nicknamed Fortinet2Shell by the researcher who found it. A malicious web page can talk to a local FortiClient service and run code. Fixed in 7.4.8 and 7.2.15; 8.0 is not affected.

FortiGate clusters, FortiMail boxes and FortiClient laptops

FortiOS 7.0 gets no fix for either FortiOS bug above. Fortinet says to migrate to a supported release, so any 7.0 firewall still in service is now a known gap.

The FortiMail bugs sit on the mail gateway, which faces the internet by design. CVE-2026-126148, a second 9.8, lets an unauthenticated attacker inject commands through HA join requests on FortiMail 7.6 and 8.0. The FortiClient flaw needs only a page visit, and the researcher says it works when FortiPAM is enabled, which puts admin workstations at the top of the list.

FortiAuthenticator also has a hard-coded password bug, CVE-2026-126257 (9.0), fixed in the same release.

Upgrade FortiOS to 7.6.8 or 7.4.13 first

• List every FortiGate with its firmware and HA mode. Clusters using FGSP with standalone-config-sync, or autoscale groups, go first: upgrade to 7.6.8, 7.4.13, 7.2.14 or 8.0.2.
• If you can’t upgrade this week, apply the FG-VD-61445.0day virtual patch from FMWP update 26.082 and restrict HA traffic to dedicated, isolated interfaces.
• Upgrade FortiMail to 7.6.7, 7.4.9 or 8.0.2. Plan a move off FortiMail 7.2.
• Push FortiClient 7.4.8 or 7.2.15 to Windows and Mac endpoints, starting with machines that run FortiPAM.
• Use Fortinet’s upgrade path tool so multi-step upgrades don’t stall halfway. If you’re building out a firewall hardening checklist for the team, the defensive basics in our GSEC exam guide are a good starting map.

Details

• CVE-2026-126259 (FG-IR-26-273): FortiOS missing authentication in HA (CWE-306), CVSS 9.0. Requires FGSP with standalone-config-sync, or autoscale. Affected 8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13, all 7.0.
• CVE-2026-126253 (FG-IR-26-267): FortiOS and FortiSASE OSPF daemon authentication bypass (CWE-305), CVSS 9.3, adjacent network. FortiSASE 26.3.2 is already remediated.
• CVE-2026-126147 (FG-IR-26-199) and CVE-2026-126148 (FG-IR-26-200): FortiMail, CVSS 9.8 each.
• CVE-2026-121529 (FG-IR-26-194): FortiClient Windows/Mac/Windows PAM origin validation error (CWE-346), CVSS 9.1, user interaction required. FortiClient Windows Free VPN is not affected.
• CVE-2026-126257 (FG-IR-26-271): FortiAuthenticator 6.6.0-6.6.10 and 8.0.0-8.0.3 hard-coded password, CVSS 9.0.
• Exploitation: Fortinet lists every advisory as not known exploited, as of November 11.

Hunt / verify

• Run get system status and get system ha status on each FortiGate and record the version and HA mode.
• Check which interfaces carry HA and session-sync traffic, and make sure none of them face an untrusted network.
• On Windows endpoints, look for a listener on TCP 9191 and a FortiVRS.exe process, which iSecRadar lists as signs the vulnerable FortiClient service is present.
• In EDR, look for cmd.exe or PowerShell started by any Forti* process in the last two weeks.

Source: Fortinet FG-IR-26-273 (FortiOS HA); SecurityWeek report

Sources

• Fortinet PSIRT FG-IR-26-273: FortiOS missing authentication in HA (CVE-2026-126259)
• Fortinet PSIRT FG-IR-26-267: FortiOS OSPF authentication bypass (CVE-2026-126253)
• Fortinet PSIRT FG-IR-26-199: FortiMail path traversal (CVE-2026-126147)
• Fortinet PSIRT FG-IR-26-200: FortiMail HA command injection (CVE-2026-126148)
• Fortinet PSIRT FG-IR-26-194: FortiClient origin validation error (CVE-2026-121529)
• Fortinet PSIRT FG-IR-26-271: FortiAuthenticator hard-coded password (CVE-2026-126257)
• SecurityWeek: Fortinet Patches Nearly 100 Vulnerabilities
• OpenAdvisories: Fortinet PSIRT Monthly Advisories, November 2026
• iSecRadar: Fortinet2Shell, FortiClient CVE-2026-121529 lets a web page run code

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].