{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fortios-7.2.x--7.2.14-7.4.x--7.4.13-7.6.x--7.6.8-8.0.x--8.0.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2025-61625"},{"cvss":8.1,"id":"CVE-2026-121528"},{"cvss":6.6,"id":"CVE-2026-121530"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FortiAnalyzer Cloud (7.2.x \u003c 7.2.13, 7.4.x \u003c 7.4.12, 7.6.x \u003c 7.6.8, 8.0.x \u003c 8.0.3)","FortiAnalyzer (7.2.x \u003c 7.2.13, 7.4.x \u003c 7.4.12, 7.6.x \u003c 7.6.8, 8.0.x \u003c 8.0.2)","FortiManager Cloud (7.2.x \u003c 7.2.13, 7.4.x \u003c 7.4.12, 7.6.x \u003c 7.6.8, 8.0.x \u003c 8.0.2)","FortiManager (7.2.x \u003c 7.2.13, 7.4.x \u003c 7.4.12, 7.6.x \u003c 7.6.8, 8.0.x \u003c 8.0.2)","FortiOS (7.2.x \u003c 7.2.14, 7.4.x \u003c 7.4.13, 7.6.x \u003c 7.6.8, 8.0.x \u003c 8.0.2)","FortiPAM (1.x)","FortiSandbox Cloud (5.0.4 \u003c 5.0.6)","FortiSandbox PaaS (5.0.4 \u003c 5.0.6)","FortiSandbox (4.4.x \u003c 4.4.9, 5.0.x \u003c 5.0.6)","FortiSASE (all versions)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","network-security","fortinet","patch-management"],"_cs_type":"advisory","_cs_vendors":["Fortinet"],"content_html":"\u003cp\u003eOn November 10, 2026, Fortinet released a series of security bulletins (FG-IR-26-142 through FG-IR-26-276) addressing a broad collection of vulnerabilities affecting multiple products. These vulnerabilities, which include CVE-2025-61625, CVE-2026-121528, and CVE-2026-121530, pose significant risks including arbitrary code execution, privilege escalation, cross-site scripting (XSS), SQL injection, server-side request forgery (SSRF), and denial-of-service conditions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe disclosed vulnerabilities impact the integrity and confidentiality of data within affected Fortinet systems. Attackers may achieve remote code execution or escalate privileges, potentially leading to a full system compromise. The scope covers major enterprise infrastructure components, including firewalls (FortiOS), centralized management platforms (FortiManager), logging solutions (FortiAnalyzer), and sandbox analysis environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all internal and cloud-hosted Fortinet infrastructure against the identified vulnerable versions.\u003c/li\u003e\n\u003cli\u003eUpgrade FortiAnalyzer, FortiManager, and FortiOS to the minimum patched versions listed in the vendor advisories immediately.\u003c/li\u003e\n\u003cli\u003eApply available patches for FortiSandbox and FortiPAM as detailed in the respective FG-IR bulletins.\u003c/li\u003e\n\u003cli\u003eReview the comprehensive list of Fortinet PSIRT bulletins at \u003ca href=\"https://fortiguard.fortinet.com/psirt/\"\u003ehttps://fortiguard.fortinet.com/psirt/\u003c/a\u003e to ensure specific product-version alignment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T16:25:54Z","date_published":"2026-11-12T16:25:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fortinet-vulnerabilities/","summary":"Fortinet has disclosed a large set of vulnerabilities across the FortiOS, FortiManager, FortiAnalyzer, and FortiSandbox ecosystems that allow for arbitrary code execution, privilege escalation, and data compromise.","title":"Fortinet Product Suite Multiple Vulnerabilities","url":"https://feed.craftedsignal.io/briefs/2026-11-fortinet-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - FortiOS (7.2.x \u003c 7.2.14, 7.4.x \u003c 7.4.13, 7.6.x \u003c 7.6.8, 8.0.x \u003c 8.0.2)","version":"https://jsonfeed.org/version/1.1"}