Fortinet recently released its November edition of security updates and 89 security advisories addressing nearly 100 vulnerabilities across its product portfolio, including approximately 17 critical and nearly 80 high-severity vulnerabilities.

With this blog, we will understand about the key vulnerabilities fixed by Fortinet with this update, the threat they pose, and what organizations should do.

Affected products

• FortiOS and FortiGate.
• FortiMail.
• FortiClient.
• FortiManager and FortiAnalyzer.
• FortiAuthenticator.
• FortiSASE.

CVE-2026-121529 – Fortinet2Shell vulnerability

Severity (CVSS) – 9.1 (Critical)

This vulnerability arises because the FotiClient’s local service does not properly validate the origin of incoming browser requests. It is due to Cross Origin Resource Sharing (CORS) misconfiguration in FortiClient’s local API endpoint.

An attacker could exploit this vulnerability to:

• Execute arbitrary code or commands on the victim’s system through the vulnerable FortiClient local API.
• Establish communication of FortiClient service with a malicious website without origin verification.
• Cause a compromise of an affected endpoint and gain access to the system by abusing the vulnerable FortiClient service.

Affected Versions:

• FortiClient Mac 7.4.0–7.4.7.
• FortiClient Windows 7.4.0–7.4.7.
• FortiClient Windows 7.2.0–7.2.14.
• FortiClient Windows PAM 7.4.0–7.4.7.
• FortiClient Windows PAM 7.2.0–7.2.14.

Fixed Versions:

• FortiClient 7.4: Upgrade to 7.4.8 or later.
• FortiClient 7.2: Upgrade to 7.2.15 or later.

Other critical vulnerabilities

Fortinet has fixed approximately 17 critical and nearly 80 high severity vulnerabilities.

Some of the other noteworthy vulnerabilities fixed include:

CVE-2026-126170 – FortiManager and FortiAnalyzer vulnerability

Severity (CVSS): 9.8 (Critical)

A JSON injection vulnerability that is caused by improper handling of the JSON input in FortiManager and FortiAnalyzer.

An attacker can exploit the flaw to

• Execute arbitrary code/commands through specially crafted HTTP requests.
• Gain unauthorized access to affected systems.
• Cause a compromise of confidentiality, availability, and integrity of systems.

Affected Versions:

• FortiManager / FortiAnalyzer 8.0.0–8.0.2.
• FortiManager / FortiAnalyzer 7.6.0–7.6.7.
• FortiManager / FortiAnalyzer 7.4.0–7.4.11.
• FortiManager / FortiAnalyzer 7.2 (all versions).
• FortiAnalyzer-BigData 7.6.0–7.6.2.Fixed Versions:
• 8.0: Upgrade to 8.0.3 or later.
• 7.6: Upgrade to 7.6.8 or later.
• 7.4: Upgrade to 7.4.12 or later.
• 7.2: Upgrade to 7.2.13 or later.
• FortiAnalyzer-BigData 7.6: Upgrade to 7.6.3 or later.

CVE-2026-126147 – FortiMail path traversal vulnerability

Severity – 9.8 (Critical)

A path traversal flaw that arises due to improper validation of file paths in FortiMail.

An attacker can exploit this flaw to:

• Execute arbitrary code on affected systems.
• Access or manipulate system resources.
• Compromise the affected email security infrastructure.

Affected Versions:

• FortiMail 8.0.0–8.0.1.
• FortiMail 7.6.0–7.6.6.
• FortiMail 7.4.0–7.4.8.
• FortiMail 7.2 (all versions).

Fixed Versions:

• 8.0: Upgrade to 8.0.2 or later.
• 7.6: Upgrade to 7.6.7 or later.
• 7.4: Upgrade to 7.4.9 or later.
• 7.2: Migrate to a fixed release.

CVE-2026-126261-FortiManager Improper Authorization vulnerability

Severity – 9 (Critical)

An improper authorization flaw in FortiManager’s FGFM protocol that allows attackers to:

• Execute arbitrary code or commands through specially crafted FGFM products.
• Bypass authorization checks.
• Gain unauthorized access.
• Cause a compromise of FortiManager and its management infrastructure.

Affected Versions:

• FortiManager 8.0.0.
• FortiManager 7.6.0–7.6.7.
• FortiManager 7.4.0–7.4.5.
• FortiManager 7.2.0–7.2.8.Fixed Versions:
• 8.0: Upgrade to 8.0.1 or later.
• 7.6: Upgrade to 7.6.8 or later.
• 7.4: Upgrade to 7.4.6 or later.
• 7.2: Upgrade to 7.2.9 or later.

SharkStriker’s recommendations

• Prioritize remediation of CVE-2026-121529.
• Upgrade affected FortiClient installations to patched versions.
• Apply all relevant Fortinet PSIRT security updates.
• Restrict access to Fortinet management interfaces.
• Enforce MFA for administrative accounts.
• Monitor suspicious endpoint and administrative activity.
• Validate successful patch deployment across affected devices.