Fortinet discloses separate FortiManager and FortiAnalyzer access flaws

The November advisories describe separate paths. Compare the exact CVE, product and branch before upgrading.

• CVE-2026-126261 (FGFM): FortiManager 8.0.0, 7.6.0–7.6.7, 7.4.0–7.4.5 and 7.2.0–7.2.8 are affected. The corresponding fixes are 8.0.1, 7.6.8, 7.4.6 and 7.2.9. The attacker must reach the FGFM service.
• CVE-2026-126170 (HTTP code execution): FortiManager and FortiAnalyzer 8.0.0–8.0.2, and their Cloud variants 8.0.1–8.0.2, are affected. For all four products, 7.6.0–7.6.7 are affected and 7.6.8 is the fix. The vendor lists 8.0.3 as upcoming for their 8.0 lines. FortiAnalyzer-BigData 7.6.0–7.6.2 is affected and 7.6.3 is listed as upcoming. Confirm availability with the vendor or your hosted service.
• CVE-2026-126229 (cross-VDOM authorization): For FortiManager and FortiAnalyzer, the CNA lists 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11, 7.2.0–7.2.12 and all 7.0. For the two Cloud variants, the ranges are 8.0.1, 7.6.0–7.6.7, 7.4.1–7.4.11, 7.2.1–7.2.12 and all 7.0. The published targets are 8.0.2, 7.6.8, 7.4.12 and 7.2.13. Ask Fortinet for a migration path from 7.0. This issue requires an authenticated administrator.

Fortinet says the HTTP code execution path requires the JSON API, which is off by default. Use the vendor CLI workaround on each administrator profile with API access enabled while waiting for a fix. Check whether disabling it affects automation and verify the effective permissions after applying the change.

config system admin profile
  edit <profile name>
    set rpc-permit none
end

The October hardening notice gave product-level guidance before the detailed advisories. In particular, the 8.0.2 target from that notice is still in the affected ranges for CVE-2026-126170. No verified exploitation or victim data was identified for these three CVEs.