Vulnerabilities · 18h ago
NCSC-NL reported on Nov. 12, 2026, that Fortinet had fixed 43 vulnerabilities across FortiManager, FortiAnalyzer, their cloud versions and related products, including FortiAnalyzer-BigData and FortiSASE-Sovereign.
The flaws include authentication and authorization bypasses, command and SQL injection, and errors in file handling. Depending on the vulnerability, attackers may need an account—or may not need to authenticate—to run commands, alter configurations, or read and change files. The prerequisites and consequences vary across the set.
Because FortiManager centrally manages security infrastructure, a compromise could affect managed devices and disrupt the management and analysis layer, not just one appliance. For organizations using cloud or sovereign variants, the exposure extends to those deployments too; the supplied NCSC-NL summary gives no fixed release versions or evidence of exploitation.
CVEs in this update
43 CVEs
Across FortiManager, FortiAnalyzer, FortiManager Cloud, and related packages.
3 critical · 10 high · 0 medium · 0 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-126170 · 9.8 CRITICAL
Showing the top 10 by KEV, EPSS, and severity.
1 source covering this story
Kwetsbaarheden verholpen in Fortinet FortiManager en FortiAnalyzer
Fortinet heeft meerdere kwetsbaarheden verholpen in FortiManager en FortiAnalyzer, inclusief hun cloudversies en aanverwante producten zoals FortiManager Cloud, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiSASE-Sovereign en FortiSASE-Sovereign GUI.
Part of the PlainSec briefing for 2026-11-12