Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Unauthenticated Remote Code Execution (CVE-2026-126170, CVE-2026-126261, CVE-2026-126262, CVE-2026-126260) and Critical FortiOS Flaws

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5722 across Splunk SPL, Microsoft KQL and Sigma, covering 3 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fortinet FortiManager/FortiAnalyzer FGFM TCP/541 and OFTP TCP/514 Access From Public Sources — Exploitation (CVE-2026-126261/126262/126260)

Behaviour-first detection of non-RFC1918 sources reaching the FGFM (TCP/541) and OFTP (TCP/514) services of FortiManager/FortiAnalyzer. These pre-authentication services are targeted by CVE-2026-126261 (FGFM improper authorization), CVE-2026-126262 (OFTP SQL injection) and CVE-2026-126260 (OFTP SSRF); the vendor offers no workaround, so reachability from unexpected sources is the best early indicator. Separates allowed from blocked flows.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1210
• Data sources: fortigate_traffic_logs, firewall_logs, fortinet_fgt_traffic
• Severity: high
• Confidence: medium

Splunk SPL

index=netfw sourcetype=fgt_traffic earliest=-24h (dstport=541 OR dstport=514)
| where NOT (cidrmatch("10.0.0.0/8",srcip) OR cidrmatch("172.16.0.0/12",srcip) OR cidrmatch("192.168.0.0/16",srcip))
| eval service=if(dstport==541,"FGFM","OFTP"), outcome=if(in(action,"deny","blocked","dropped"),"blocked","allowed")
| stats count as connections dc(dstip) as target_count values(dstip) as targets sum(sentbyte) as bytes_sent min(_time) as first_seen max(_time) as last_seen by srcip service outcome
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - connections

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ "Fortinet"
| where DestinationPort in (541, 514)
| where not(ipv4_is_private(SourceIP))
| extend Service = iff(DestinationPort == 541, "FGFM", "OFTP"), Outcome = iff(DeviceAction in~ ("deny", "blocked", "dropped"), "blocked", "allowed")
| summarize Connections = count(), Targets = make_set(DestinationIP, 10), BytesSent = sum(SentBytes), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, Service, Outcome
| project FirstSeen, LastSeen, SourceIP, Service, Outcome, Connections, Targets, BytesSent

Sigma

title: Inbound FGFM/OFTP Connection From Non-RFC1918 Source To Fortinet Management Plane
id: 5722a001-1f4e-4b1a-9c01-0a1b2c3d4e01
status: experimental
description: Detects connections from public addresses to FGFM (TCP/541) or OFTP (TCP/514), the services exposed to unauthenticated attack by CVE-2026-126261, CVE-2026-126262 and CVE-2026-126260 on FortiManager and FortiAnalyzer.
references:
  - https://fortiguard.fortinet.com/psirt/FG-IR-26-219
  - https://www.fortiguard.com/psirt/FG-IR-26-275
  - https://fortiguard.fortinet.com/psirt/FG-IR-26-276
  - https://fortiguard.fortinet.com/psirt/FG-IR-26-274
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial_access
  - attack.t1190
  - attack.lateral_movement
  - attack.t1210
  - cve.2026.126170
  - cve.2026.126261
  - cve.2026.126262
  - cve.2026.126260
logsource:
  category: firewall
detection:
  selection:
    dst_port:
      - 541
      - 514
  filter_internal:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate FortiGate or FortiAnalyzer devices registering from public IP space
  - Authorized remote log forwarding over OFTP from branch firewalls
level: high

Known false positives:

• FortiGate/FortiAnalyzer peers legitimately registering or forwarding logs from public IP addresses
• Authorized vulnerability scanners probing TCP/541 and TCP/514

Tuning notes: Allowlist known FortiGate/FortiAnalyzer peer IPs (add NOT srcip IN (...)). Adjust index/sourcetype to your FortiGate add-on. Prioritise outcome=allowed against internet-facing management appliances; extend the private-range exclusion with your own CGNAT/partner ranges.

• 🔒 Burst Of Public Connections To FortiManager/FortiAnalyzer FGFM and OFTP Ports — Exploitation Attempts · unlock with TL Creds
• 🔒 FortiOS Administrator Configuration Changes Across Multiple VDOMs — Privilege Escalation · unlock with TL Creds
• 🔒 FortiManager/FortiAnalyzer Outbound Connection To Public Host On Unexpected Port — C2 / SSRF Callback · unlock with TL Creds
• 🔒 FortiManager/FortiAnalyzer JSON-RPC API POST From Public Client — Exploitation (CVE-2026-126170) · unlock with TL Creds
• 🔒 FortiManager/FortiAnalyzer Administrator Account Added or Modified — Post-Exploitation Persistence · unlock with TL Creds
• 🔒 FortiOS OSPF Authentication Failure or BGP Update Error — Routing Manipulation (CVE-2026-126253/126254) · unlock with TL Creds
• 🔒 FortiManager/FortiAnalyzer Admin Profile rpc-permit (JSON API) Enabled or Tampered — Post-Exploitation · unlock with TL Creds
• 🔒 FGFM TCP/541 Fan-out From Non-FortiManager Host — Lateral Movement (CVE-2026-126261) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 3 indicators of compromise for TL-2026-5722.

Technical analysis

CVE-2026-126261 was not known to be exploited at publication, and no public PoC, attribution or in-the-wild exploitation is reported for any of the CVEs.

On 2026-11-10 Fortinet disclosed a batch of critical vulnerabilities affecting its management and log-analytics platforms (FortiManager, FortiAnalyzer and their Cloud variants) and FortiOS. Four of the flaws are pre-authentication issues in management-plane services.

CVE-2026-126170 (FG-IR-26-219, CVSS 9.8, CWE-116 improper encoding/escaping of output) affects the GUI/JSON-RPC API. An unauthenticated attacker may run unauthorized code or commands through a crafted HTTP request. It only applies when the JSON API is enabled, which is disabled by default. The advisory lists FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud 8.0.0-8.0.2 and 7.6.0-7.6.7, FortiAnalyzer-BigData 7.6.0-7.6.2, and FortiSASE-Sovereign 25.x. Branches 7.4 and 7.2 are not affected. Fixes are 8.0.3, 7.6.8 and 7.6.3 (BigData). The workaround is to set rpc-permit to none under 'config system admin profile'.

CVE-2026-126261 (FG-IR-26-275, CVSS 9.0) is an improper authorization weakness in the FortiManager FGFM service (TCP/541). An unauthenticated attacker who can reach the FGFM port may execute code or commands with crafted FGFM packets, because the check happens before the registration password is verified. Affected: FortiManager 8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.5 and 7.2.0-7.2.8. Fixed: 8.0.1, 7.6.8, 7.4.6 and 7.2.9. No workaround or virtual patch is listed, and the source says it was not known to be exploited at publication.

CVE-2026-126262 (FG-IR-26-276, CVSS 9.3, CWE-89) is an SQL injection in the OFTP service (TCP/514) of FortiAnalyzer, and of FortiManager with FortiAnalyzer features enabled. It allows an unauthenticated attacker to execute code or commands via crafted OFTP packets. Fixed in 8.0.1/8.0.2, 7.6.8, 7.4.12 and 7.2.13, depending on product. CVE-2026-126260 (FG-IR-26-274, CVSS 9.0, CWE-918) is a pre-authentication SSRF in the same OFTP service. The advisory lists code or command execution as the impact, while press coverage says RCE is not confirmed. It affects 8.0.0, 7.6.0-7.6.7 and 7.4.0-7.4.11, and is fixed in 8.0.1, 7.6.8 and 7.4.12. Neither OFTP flaw has a workaround.

Four FortiOS flaws were also reported, per the press article only. The Fortinet advisories for these were not independently retrieved. CVE-2026-126254 (CVSS 9.6) is a BGP numeric truncation that needs traffic from a configured iBGP neighbor. CVE-2026-126253 (CVSS 9.3) is an OSPF authentication bypass that could permit forged routing advertisements. CVE-2026-126229 (CVSS 9.1) lets an authenticated admin reach VDOMs outside their scope. CVE-2026-126259 (CVSS 9.0) allows super-admin command execution in specific FGSP standalone-config-sync or autoscale configurations. Restricting the browser login page does not protect FGFM or OFTP. Defenders should prioritize internet-exposed management interfaces, back up configurations and monitor for unauthorized changes.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1565.002 Transmitted Data Manipulation

Remediation

Patches

• FortiManager/FortiAnalyzer 8.0: 8.0.1 (CVE-2026-126261, -126260, -126262 for FortiManager), 8.0.2 (FortiAnalyzer CVE-2026-126262), 8.0.3 (CVE-2026-126170)
• FortiManager/FortiAnalyzer 7.6: 7.6.8 or later
• FortiManager/FortiAnalyzer 7.4: 7.4.6 (FGFM) and 7.4.12 (OFTP) or later
• FortiManager/FortiAnalyzer 7.2: 7.2.9 (FGFM) and 7.2.13 (OFTP SQLi) or later
• FortiAnalyzer-BigData 7.6: 7.6.3 or later (CVE-2026-126170)
• Apply FortiOS fixes per the Fortinet advisories for CVE-2026-126254, -126253, -126229 and -126259

Immediate actions

• If the JSON API is enabled, set rpc-permit to none under 'config system admin profile' for each relevant admin profile (workaround for CVE-2026-126170)
• Restrict network access to FGFM (TCP/541) and OFTP (TCP/514) to trusted FortiGate/FortiAnalyzer devices only; browser login-page restrictions do not protect these services
• Back up configurations and monitor for unauthorized configuration changes

Workarounds

• CVE-2026-126170: disable JSON API access via rpc-permit none
• No workaround or virtual patch listed for CVE-2026-126261, CVE-2026-126262 or CVE-2026-126260

Longer-term hardening

• Do not expose FortiManager/FortiAnalyzer management and FGFM/OFTP services to the internet
• Do not assume an October build fixes every November finding; fixes vary by vulnerability and branch

Affected and fixed versions

• Fortinet — FortiManager
  Vulnerable versions: 8.0.0-8.0.2 (CVE-2026-126170); 7.6.0-7.6.7; 7.4.0-7.4.5 (FGFM); 7.4.0-7.4.11 (OFTP); 7.2.0-7.2.8 (FGFM); 7.2.0-7.2.12 (OFTP SQLi)
  Fixed in: 8.0.1; 8.0.3 (JSON API); 7.6.8; 7.4.6; 7.4.12; 7.2.9; 7.2.13
• Fortinet — FortiAnalyzer
  Vulnerable versions: 8.0.0-8.0.2; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12 (OFTP SQLi)
  Fixed in: 8.0.1; 8.0.2; 8.0.3 (JSON API); 7.6.8; 7.4.12; 7.2.13
• Fortinet — FortiManager Cloud / FortiAnalyzer Cloud
  Vulnerable versions: 8.0.1-8.0.2; 7.6.0-7.6.7 (CVE-2026-126170)
  Fixed in: 8.0.3; 7.6.8
• Fortinet — FortiAnalyzer-BigData
  Vulnerable versions: 7.6.0-7.6.2 (CVE-2026-126170)
  Fixed in: 7.6.3
• Fortinet — FortiSASE-Sovereign
  Vulnerable versions: 25, 25.3, 25.4 (all versions, CVE-2026-126170)
  Fixed in: Migrate to a fixed release; 26.2 fixed but not yet released
• Fortinet — FortiOS
  Vulnerable versions: Versions not stated in source (CVE-2026-126254, -126253, -126229, -126259)
  Fixed in: See Fortinet advisories

Timeline

• 2026-11-10 Cyber Security News reports the flaws; CVE-2026-126261 is stated as not known to be exploited at publication, and no exploitation status is given for the others.
• 2026-11-10 Four critical FortiOS flaws reported alongside the management-plane batch: CVE-2026-126254 (iBGP), CVE-2026-126253 (OSPF auth bypass), CVE-2026-126229 (cross-VDOM), CVE-2026-126259 (super-admin command execution).
• 2026-11-10 Fortinet publishes FG-IR-26-274 (CVE-2026-126260, CVSS 9.0): pre-authentication SSRF in the OFTP service; no workaround or virtual patch.
• 2026-11-10 Fortinet publishes FG-IR-26-276 (CVE-2026-126262, CVSS 9.3): OFTP SQL injection in FortiAnalyzer and FortiManager with FortiAnalyzer features.
• 2026-11-10 Fortinet publishes FG-IR-26-275 (CVE-2026-126261, CVSS 9.0): FGFM improper authorization in FortiManager; fixed in 8.0.1, 7.6.8, 7.4.6 and 7.2.9.
• 2026-11-10 Fortinet publishes FG-IR-26-219 (CVE-2026-126170, CVSS 9.8): JSON injection/improper output encoding in the FortiManager/FortiAnalyzer JSON API; 8.0.3 fix listed for the 8.0 branch.

Sources cited

• Fortinet PSIRT FG-IR-26-219 (CVE-2026-126170) Fortinet · Vendor report · 2026-11-10
• Fortinet PSIRT FG-IR-26-274 (CVE-2026-126260) Fortinet · Vendor report · 2026-11-10
• Fortinet PSIRT FG-IR-26-275 (CVE-2026-126261) FortiGuard Labs · Vendor report · 2026-11-10
• Fortinet PSIRT FG-IR-26-276 (CVE-2026-126262) Fortinet · Vendor report · 2026-11-10
• Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login cybersecuritynews.com · News · 2026-11-10

More in vulnerability

• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches

Previous and next in vulnerability

• Six OpenClaw Vulnerabilities (SSRF, Webhook Auth Bypass, Path Traversal) incl. CVE-2026-26322, CVE-2026-26319, CVE-2026-26329 Previous report
• Shadow AI-Generated Apps: Unreviewed AI app-builder deployments exposing cloud data (incl. CVE-2025-48757 Supabase missing-policy example) Next report