Fortinet Discloses Seven Critical Flaws Across Its Product Line

Fortinet published eight security advisories on November 10 covering seven critical vulnerabilities across its firewall and management products. [Fortinet critical vulnerabilities, November 2026: eight advisories, seven critical CVEs — SecurityOnline, reporting Fortinet's PSIRT advisories]

The worst, CVE-2026-126170, scores 9.8 and lets an unauthenticated attacker execute code through an output-encoding flaw in the products' JSON RPC interface, which is disabled by default. Six of the seven critical flaws require no login to exploit. [Fortinet critical vulnerabilities, November 2026: eight advisories, seven critical CVEs — SecurityOnline, reporting Fortinet's PSIRT advisories]

The advisories span the line network defenders actually run: FortiOS on the firewalls themselves, FortiManager and FortiAnalyzer, the management and logging layer, and FortiSASE, the cloud-delivered service. Almost all of the flaws were found internally, some with assistance from Anthropic's Claude Mythos per SecurityOnline's reading of the advisories, rather than reported by outside researchers after exploitation. That ordering matters: Fortinet states none of the seven has been confirmed exploited in the wild, which makes this a patch-race disclosure rather than a breach response. The complication is completeness: for some of the flaws the fixed versions are listed as upcoming, so administrators can inventory their exposure before they can close it. [Fortinet critical vulnerabilities, November 2026: eight advisories, seven critical CVEs — SecurityOnline, reporting Fortinet's PSIRT advisories]

The backdrop is volume: CISA's Known Exploited Vulnerabilities catalog already lists 32 Fortinet flaws, a history that made the company's edge devices a standard first target in past intrusion campaigns and that shapes how seriously a 9.8 with no login required gets taken, even with the vulnerable interface off by default. The action list for operators is unglamorous and specific: confirm whether the JSON RPC interface is enabled anywhere, apply the fixed releases that exist, schedule the rest, and treat management-plane exposure as the emergency it has repeatedly been. Disclosures like this one are the system working; the failures don't happen at disclosure. They happen in the gap between the advisory and the patch window closing. [Fortinet critical vulnerabilities, November 2026: eight advisories, seven critical CVEs — SecurityOnline, reporting Fortinet's PSIRT advisories]