Threat video1:00
FortiManager, FortiAnalyzer RCE Flaws: Detection & IOCs
Fixes for FortiManager, FortiAnalyzer and FortiOS include CVE-2026-126170, an unauthenticated RCE: 9 detection rules, 3 IOCs and a free Splunk SPL rule.
Read the full threat intel for FortiManager, FortiAnalyzer RCE Flaws: Detection & IOCs →
Chapters
- 0:00The hookFortinet fixed a 9.8 flaw: unauthenticated code execution.
- 0:05The storyFortinet disclosed critical flaws in management platforms.
- 0:13Attack pathAttackers reach a management service.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques3 ATT&CK techniques, from initial access to impact.
- 0:43Remediation3 steps now: If the JSON API is enabled, set rpc-permit to none.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fortinet fixed a 9.8 flaw: unauthenticated code execution.
0:06Fortinet disclosed critical flaws in management platforms.
0:10No known exploitation is reported.
0:14Attackers reach a management service.
0:16Only with JSON API enabled, one flaw runs code.
0:20Any one pre-auth route gives a foothold.
0:23Then unauthorized code or commands may run.
0:28No threat actor is attributed. Confidence: low.
0:33No malicious indicators were published.
0:383 ATT&CK techniques, from initial access to impact.
0:433 steps now: If the JSON API is enabled, set rpc-permit to none.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.