Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Fortinet Releases Security Advisories Addressing Multiple Critical Vulnerabilities

Security advisories address 98 vulnerabilities across multiple Fortinet products, including 19 critical vulnerabilities

Threat ID:
CC-4888
Threat Severity:
Medium
Published:
11 November 2026 2:35 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security advisories address 98 vulnerabilities across multiple Fortinet products, including 19 critical vulnerabilities

Affected platforms

The following platforms are known to be affected:

Fortinet FortiOS

  • All prior to 8.0.2
  • All prior to 7.6.8
  • All prior to 7.4.13
  • All prior to 7.2.14

Note: Individual vulnerabilities affect different FortiOS services and configurations. Organisations are encouraged to review the relevant Fortinet PSIRT advisories and follow Fortinet's recommended upgrade or migration guidance.

Fortinet FortiManager

  • All prior to 8.0.2
  • All prior to 7.6.8
  • All prior to 7.4.12
  • All prior to 7.2.13

Note: Individual vulnerabilities affect different FortiManager services and configurations. Organisations are encouraged to review the relevant Fortinet PSIRT advisories and follow Fortinet's recommended upgrade or migration guidance.

Fortinet FortiAnalyzer

  • All prior to 8.0.2
  • All prior to 7.6.8
  • All prior to 7.4.12
  • All  prior to 7.2.13

Note: Individual vulnerabilities affect different FortiAnalyzer services and configurations. Organisations are encouraged to review the relevant Fortinet PSIRT advisories and follow Fortinet's recommended upgrade or migration guidance.

Fortinet FortiMail

  • All prior to 8.0.2
  • All prior to 7.6.7
  • All prior to 7.4.9
  • 7.2.0 through 7.2.9

Note: Individual vulnerabilities affect different FortiMail services and configurations. Organisations are encouraged to review the relevant Fortinet PSIRT advisories and follow Fortinet's recommended upgrade or migration guidance.

Fortinet FortiAuthenticator

  • All prior to 8.0.4
  • All prior to 6.6.11

Note: Individual vulnerabilities affect different FortiAuthenticator services and configurations. Organisations are encouraged to review the relevant Fortinet PSIRT advisories and follow Fortinet's recommended upgrade or migration guidance.

The following platforms are also known to be affected:

Multiple other Fortinet platforms are affected, please see Fortinet advisories for further details.

Threat details

Security Updates Released Prior to Disclosure

Fortinet released security hardening updates before publishing technical details of the vulnerabilities. They stated that this was intended to provide organisations with additional time to apply updates due to concerns that threat actors could rapidly reverse engineer security patches and develop functional exploits following disclosure.

CC-4879 - Fortinet Releases Security Hardening Release for Multiple Products previously covered this release.

Now these vulnerabilities have been disclosed, the NHS England National CSOC assesses exploitation as likely.

Introduction

Fortinet has published security advisories addressing 98 vulnerabilities affecting multiple Fortinet products, including 19 critical vulnerabilities.

Five of the most significant vulnerabilities are:

  • CVE-2026-126170 - 'Improper Encoding or Escaping of Output' vulnerability - CVSS v3.1 score: 9.8
  • CVE-2026-126262 - 'Improper Neutralization of Special Elements used in an SQL Command' vulnerability - CVSS v3.1 score: 9.3
  • CVE-2026-126253 - 'Authentication Bypass by Primary Weakness' vulnerability - CVSS v3.1 score: 9.3
  • CVE-2026-126261 - 'Improper Authorization' vulnerability - CVSS v3.1 score: 9.0
  • CVE-2026-126259 - 'Missing Authentication for Critical Function' vulnerability - CVSS v3.1 score: 9.0

Remediation advice

Affected organisations are encouraged to review the Fortinet Security Hardening Release, originally published in October, and apply the relevant updates as soon as possible.

Organisations should follow Fortinet's product specific upgrade guidance, as affected and fixed versions vary between vulnerabilities, product branches and configurations.

Last edited: 11 November 2026 2:35 pm