Fortinet has published a batch of critical security advisories for FortiManager and FortiAnalyzer, the servers companies use to manage firewalls and collect their logs. Several of the flaws let an attacker run code on the server without logging in, so anyone who runs these products should check their version today.
The advisories came out on 10 November as part of Fortinet’s monthly disclosure. The patches themselves were released earlier, on 22 October, which means attackers now have a public description of what was fixed. Fortinet warns that attackers can now use AI to pick apart a patch and have a working exploit within hours or days.
The first of them is FG-IR-26-219, a flaw in the JSON API of FortiManager and FortiAnalyzer, including their cloud versions. One specially built web request is enough for someone with no account to run commands on the box. The risk exists only when the JSON API is switched on, which is not the default, and Fortinet’s page gives a setting to turn it off for any profile that has it enabled.
Three more advisories cover other doors into the same servers. FortiManager’s FGFM service, advisory FG-IR-26-275, can be abused by any outsider who reaches its network port, and Fortinet rates it Critical. FG-IR-26-276 is an SQL injection reached through the OFTP port, and FG-IR-26-274 is a request-forgery bug on the same port. The last two affect FortiAnalyzer, and FortiManager units that have FortiAnalyzer features switched on.
Fortinet’s guidance post lists the affected builds. FortiManager and FortiAnalyzer 7.6.0 to 7.6.7 should move to 7.6.8, 7.4.0 to 7.4.11 to 7.4.12, and 7.2.0 to 7.2.12 to 7.2.13. FortiOS 7.6.0 to 7.6.7, 7.4.0 to 7.4.12 and 7.2.0 to 7.2.13 need 7.6.8, 7.4.13 and 7.2.14, and FortiMail 7.2 users are told to move to the 7.4 branch or later.
The fixes came out of a programme in which Fortinet used frontier AI models to test its own code, and the company thanked Anthropic, OpenAI, Google and SpaceX for working with it. Fortinet admits the same kind of AI is reaching attackers, particularly as open-weight models improve, and says this release should be treated as a priority rather than routine maintenance.
Where patching has to wait, the company advises keeping management interfaces off the internet, restricting HTTPS and SSH to trusted addresses, putting devices behind a VPN or SASE, and applying virtual patches. Internet-facing systems come first, and a configuration backup should be taken before upgrading.
