Fortinet Multiple Products: Multiple Vulnerabilities (CVE-2026-126xxx et al.)

Multiple vulnerabilities have been identified across Fortinet product lines, including FortiOS, FortiManager, FortiAnalyzer, FortiSASE, FortiPAM, and FortiSandbox. The most severe flaws permit arbitrary code execution, which could allow an attacker to install software, modify or delete data, and create administrative accounts. As of this advisory, there are no reports of these vulnerabilities being exploited in the wild.

Impact

Successful exploitation could allow unauthorized arbitrary code execution, potential full system compromise, and privilege escalation depending on the account rights associated with the targeted service or session.

Recommendation

• Identify all instances of affected Fortinet products within the environment based on the versions listed.
• Review the official Fortinet security advisories to obtain specific patches for each product version.
• Prioritize patching for internet-facing systems such as FortiManager and FortiOS gateways.
• Implement a risk-based patch management cycle as outlined by the MS-ISAC guidance.