# Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Unauthenticated Remote Code Execution (CVE-2026-126170, CVE-2026-126261, CVE-2026-126262, CVE-2026-126260) and Critical FortiOS Flaws

> Fortinet published fixes on 2026-11-10 for multiple critical (CVSS 9.0-9.8) flaws in FortiManager, FortiAnalyzer and FortiOS. The headline flaw, CVE-2026-126170 (CVSS 9.8, FG-IR-26-219), lets an unauthenticated attacker run code or commands through a crafted HTTP request when the JSON API is enabled. CVE-2026-126261 was not known to be exploited at publication, and no public PoC, attribution or in-the-wild exploitation is reported for any of the CVEs.

- **Published:** 2026-11-11T03:25:43Z
- **Last reviewed:** 2026-11-11T03:25:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5722
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5722.png
- **ID:** TL-2026-5722
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 3
- **CVEs:** CVE-2026-126170, CVE-2026-126261, CVE-2026-126262, CVE-2026-126260, CVE-2026-126254, CVE-2026-126253, CVE-2026-126229, CVE-2026-126259

## Description

On 2026-11-10 Fortinet disclosed a batch of critical vulnerabilities affecting its management and log-analytics platforms (FortiManager, FortiAnalyzer and their Cloud variants) and FortiOS. Four of the flaws are pre-authentication issues in management-plane services.

CVE-2026-126170 (FG-IR-26-219, CVSS 9.8, CWE-116 improper encoding/escaping of output) affects the GUI/JSON-RPC API. An unauthenticated attacker may run unauthorized code or commands through a crafted HTTP request. It only applies when the JSON API is enabled, which is disabled by default. The advisory lists FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud 8.0.0-8.0.2 and 7.6.0-7.6.7, FortiAnalyzer-BigData 7.6.0-7.6.2, and FortiSASE-Sovereign 25.x. Branches 7.4 and 7.2 are not affected. Fixes are 8.0.3, 7.6.8 and 7.6.3 (BigData). The workaround is to set rpc-permit to none under 'config system admin profile'.

CVE-2026-126261 (FG-IR-26-275, CVSS 9.0) is an improper authorization weakness in the FortiManager FGFM service (TCP/541). An unauthenticated attacker who can reach the FGFM port may execute code or commands with crafted FGFM packets, because the check happens before the registration password is verified. Affected: FortiManager 8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.5 and 7.2.0-7.2.8. Fixed: 8.0.1, 7.6.8, 7.4.6 and 7.2.9. No workaround or virtual patch is listed, and the source says it was not known to be exploited at publication.

CVE-2026-126262 (FG-IR-26-276, CVSS 9.3, CWE-89) is an SQL injection in the OFTP service (TCP/514) of FortiAnalyzer, and of FortiManager with FortiAnalyzer features enabled. It allows an unauthenticated attacker to execute code or commands via crafted OFTP packets. Fixed in 8.0.1/8.0.2, 7.6.8, 7.4.12 and 7.2.13, depending on product. CVE-2026-126260 (FG-IR-26-274, CVSS 9.0, CWE-918) is a pre-authentication SSRF in the same OFTP service. The advisory lists code or command execution as the impact, while press coverage says RCE is not confirmed. It affects 8.0.0, 7.6.0-7.6.7 and 7.4.0-7.4.11, and is fixed in 8.0.1, 7.6.8 and 7.4.12. Neither OFTP flaw has a workaround.

Four FortiOS flaws were also reported, per the press article only. The Fortinet advisories for these were not independently retrieved. CVE-2026-126254 (CVSS 9.6) is a BGP numeric truncation that needs traffic from a configured iBGP neighbor. CVE-2026-126253 (CVSS 9.3) is an OSPF authentication bypass that could permit forged routing advertisements. CVE-2026-126229 (CVSS 9.1) lets an authenticated admin reach VDOMs outside their scope. CVE-2026-126259 (CVSS 9.0) allows super-admin command execution in specific FGSP standalone-config-sync or autoscale configurations. Restricting the browser login page does not protect FGFM or OFTP. Defenders should prioritize internet-exposed management interfaces, back up configurations and monitor for unauthorized changes.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1565.002 Transmitted Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fortinet FortiManager/FortiAnalyzer FGFM TCP/541 and OFTP TCP/514 Access From Public Sources — Exploitation (CVE-2026-126261/126262/126260)** (`TL-2026-5722-SPL-001`)

Behaviour-first detection of non-RFC1918 sources reaching the FGFM (TCP/541) and OFTP (TCP/514) services of FortiManager/FortiAnalyzer. These pre-authentication services are targeted by CVE-2026-126261 (FGFM improper authorization), CVE-2026-126262 (OFTP SQL injection) and CVE-2026-126260 (OFTP SSRF); the vendor offers no workaround, so reachability from unexpected sources is the best early indicator. Separates allowed from blocked flows.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1210
- **Data sources:** fortigate_traffic_logs, firewall_logs, fortinet_fgt_traffic
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=netfw sourcetype=fgt_traffic earliest=-24h (dstport=541 OR dstport=514)
| where NOT (cidrmatch("10.0.0.0/8",srcip) OR cidrmatch("172.16.0.0/12",srcip) OR cidrmatch("192.168.0.0/16",srcip))
| eval service=if(dstport==541,"FGFM","OFTP"), outcome=if(in(action,"deny","blocked","dropped"),"blocked","allowed")
| stats count as connections dc(dstip) as target_count values(dstip) as targets sum(sentbyte) as bytes_sent min(_time) as first_seen max(_time) as last_seen by srcip service outcome
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| sort - connections
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ "Fortinet"
| where DestinationPort in (541, 514)
| where not(ipv4_is_private(SourceIP))
| extend Service = iff(DestinationPort == 541, "FGFM", "OFTP"), Outcome = iff(DeviceAction in~ ("deny", "blocked", "dropped"), "blocked", "allowed")
| summarize Connections = count(), Targets = make_set(DestinationIP, 10), BytesSent = sum(SentBytes), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, Service, Outcome
| project FirstSeen, LastSeen, SourceIP, Service, Outcome, Connections, Targets, BytesSent
```

### Sigma

```yaml
title: Inbound FGFM/OFTP Connection From Non-RFC1918 Source To Fortinet Management Plane
id: 5722a001-1f4e-4b1a-9c01-0a1b2c3d4e01
status: experimental
description: Detects connections from public addresses to FGFM (TCP/541) or OFTP (TCP/514), the services exposed to unauthenticated attack by CVE-2026-126261, CVE-2026-126262 and CVE-2026-126260 on FortiManager and FortiAnalyzer.
references:
  - https://fortiguard.fortinet.com/psirt/FG-IR-26-219
  - https://www.fortiguard.com/psirt/FG-IR-26-275
  - https://fortiguard.fortinet.com/psirt/FG-IR-26-276
  - https://fortiguard.fortinet.com/psirt/FG-IR-26-274
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial_access
  - attack.t1190
  - attack.lateral_movement
  - attack.t1210
  - cve.2026.126170
  - cve.2026.126261
  - cve.2026.126262
  - cve.2026.126260
logsource:
  category: firewall
detection:
  selection:
    dst_port:
      - 541
      - 514
  filter_internal:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate FortiGate or FortiAnalyzer devices registering from public IP space
  - Authorized remote log forwarding over OFTP from branch firewalls
level: high
```

**Known false positives:**

- FortiGate/FortiAnalyzer peers legitimately registering or forwarding logs from public IP addresses
- Authorized vulnerability scanners probing TCP/541 and TCP/514

**Tuning notes:** Allowlist known FortiGate/FortiAnalyzer peer IPs (add NOT srcip IN (...)). Adjust index/sourcetype to your FortiGate add-on. Prioritise outcome=allowed against internet-facing management appliances; extend the private-range exclusion with your own CGNAT/partner ranges.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Burst Of Public Connections To FortiManager/FortiAnalyzer FGFM and OFTP Ports — Exploitation Attempts (locked: unlock with TL Creds)
- FortiOS Administrator Configuration Changes Across Multiple VDOMs — Privilege Escalation (locked: unlock with TL Creds)
- FortiManager/FortiAnalyzer Outbound Connection To Public Host On Unexpected Port — C2 / SSRF Callback (locked: unlock with TL Creds)
- FortiManager/FortiAnalyzer JSON-RPC API POST From Public Client — Exploitation (CVE-2026-126170) (locked: unlock with TL Creds)
- FortiManager/FortiAnalyzer Administrator Account Added or Modified — Post-Exploitation Persistence (locked: unlock with TL Creds)
- FortiOS OSPF Authentication Failure or BGP Update Error — Routing Manipulation (CVE-2026-126253/126254) (locked: unlock with TL Creds)
- FortiManager/FortiAnalyzer Admin Profile rpc-permit (JSON API) Enabled or Tampered — Post-Exploitation (locked: unlock with TL Creds)
- FGFM TCP/541 Fan-out From Non-FortiManager Host — Lateral Movement (CVE-2026-126261) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login](https://cybersecuritynews.com/critical-fortinet-flaws-patched/)
- [Fortinet PSIRT FG-IR-26-219 (CVE-2026-126170)](https://fortiguard.fortinet.com/psirt/FG-IR-26-219)
- [Fortinet PSIRT FG-IR-26-274 (CVE-2026-126260)](https://fortiguard.fortinet.com/psirt/FG-IR-26-274)
- [Fortinet PSIRT FG-IR-26-275 (CVE-2026-126261)](https://www.fortiguard.com/psirt/FG-IR-26-275)
- [Fortinet PSIRT FG-IR-26-276 (CVE-2026-126262)](https://fortiguard.fortinet.com/psirt/FG-IR-26-276)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5722