Fortinet released advisories for eight critical vulnerabilities, rated between CVSS 9.0 and 9.8, across FortiOS, FortiManager, FortiAnalyzer and FortiSASE. Six of the eight can be exploited without authentication, and Fortinet has not confirmed any exploitation.
The disclosures land on products that sit at the perimeter and management layers of enterprise networks, a position that makes them consequential when vulnerable.
The Eight Fortinet CVEs and Their Severity Scores
The highest-rated flaw is CVE-2026-126170, scoring 9.8. CVE-2026-126254 follows at 9.6, then CVE-2026-126262 and CVE-2026-126253 at 9.3 each, and CVE-2026-126229 at 9.1. Three further flaws, CVE-2026-126261, CVE-2026-126260 and CVE-2026-126259, are each rated 9.0.
The advisory data indicates that six of the eight do not require authentication. A vulnerability reachable without credentials removes the main barrier between an attacker with network access and the affected device, which is why such flaws tend to top patching priority lists.
Affected FortiOS Versions Across Four Branches
FortiOS versions 7.2.0 through 7.2.13, 7.4.0 through 7.4.12, 7.6.0 through 7.6.7 and 8.0.0 through 8.0.1 are affected. The FortiManager and FortiAnalyzer 7.2, 7.4, 7.6 and 8.0 branches are also in scope, as is FortiSASE.
Fixed Builds Fortinet Has Released
Fortinet resolved the issues in FortiOS 7.2.14, 7.4.13, 7.6.8 and 8.0.2. For FortiManager and FortiAnalyzer, the fixed versions are 7.2.13, 7.4.12, 7.6.8 and 8.0.2.
Administrators running any release within the listed vulnerable ranges can use the fixed-version list to determine the nearest upgrade target within their branch, without moving to a different major line.
No Exploitation Confirmed at Disclosure
Fortinet has not confirmed exploitation of any of the eight flaws at the time of the advisories. That status could change quickly. Fortinet’s perimeter and management products have a history of being targeted soon after vulnerabilities become public, a pattern that gives the disclosure added urgency even without an observed attack.
Why Management Platforms Raise the Stakes
FortiManager and FortiAnalyzer are central management and logging platforms. A compromise of either one can affect the many devices they administer, since these systems hold configurations and credentials for the firewalls and gateways under their control. FortiSASE, the cloud-delivered security service, adds another surface that organizations rely on for remote-user protection.
Taken together, the flaws touch the data plane (FortiOS), the control plane (FortiManager and FortiAnalyzer) and the cloud edge (FortiSASE). Defenders have to patch across all three layers rather than focusing on a single product line.
The clustering of eight critical issues in one release cycle also complicates operations. Security teams that already handled a large volume of vendor patches this month, such as the more than 1,000 fixes in Microsoft’s update, must now weigh a Fortinet upgrade for production firewalls, a task that usually involves maintenance windows and failover planning.
Organizations can reduce exposure while scheduling upgrades by limiting which networks can reach management interfaces on affected devices, a measure consistent with the advisory’s focus on unauthenticated attack paths. Where administrators cannot tell which of the eight flaws apply to a particular deployment, upgrading to the fixed build for their branch resolves all of them at once.
Triage Guidance for Fortinet Administrators
The eight CVEs span three scoring bands, but the practical triage question is which ones are reachable without credentials. Six of the eight are, and administrators should identify which of their FortiOS, FortiManager, FortiAnalyzer and FortiSASE deployments sit within the vulnerable version ranges first.
Version bookkeeping is straightforward: FortiOS 7.2.0 through 7.2.13 moves to 7.2.14, 7.4.0 through 7.4.12 to 7.4.13, 7.6.0 through 7.6.7 to 7.6.8, and 8.0.0 through 8.0.1 to 8.0.2. Management platforms follow their own list, ending at 7.2.13, 7.4.12, 7.6.8 and 8.0.2.
The fixed-version lists also show that no branch is left behind: each of the four FortiOS lines and each FortiManager and FortiAnalyzer line has its own corrected build, so administrators do not have to change release families to close the flaws.
