Fortinet released its November 2026 monthly security advisories on 10 November. Two parts of the release matter most for industrial sites: a critical flaw in FortiOS, the operating system on FortiGate firewalls that many plants use at the boundary between business and control networks, and a group of critical and high flaws in FortiManager and FortiAnalyzer, the central consoles that push configuration to those firewalls and collect their logs. Fortinet says none of these flaws is known to be exploited yet, and fixed versions are available now. Several were found by Fortinet's own product security team using an artificial intelligence (AI) model, so expect more findings like this across the industry.
CVE-2026-126253 is rated critical, 9.3 on the Common Vulnerability Scoring System (CVSS). It sits in the FortiOS process that runs Open Shortest Path First (OSPF), a routing protocol that routers and firewalls use to tell each other which networks they can reach. Fortinet says an attacker with no login could send specially crafted requests that get the firewall to broadcast routing announcements. In plain terms, false routing information could spread to other routers, which could send traffic the wrong way or cut it off. It only matters where OSPF is turned on, which is common on larger plant and utility networks with redundant paths. Affected versions are FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12 and 7.2.0 through 7.2.13. The fixes are 8.0.2, 7.6.8, 7.4.13 and 7.2.14.
CVE-2026-126261 (FG-IR-26-275), rated critical at 9.0, is in the FortiGate to FortiManager (FGFM) protocol, the channel firewalls use to register with and take orders from FortiManager. Fortinet says an attacker with no login who can reach the FGFM port could run code or commands on FortiManager or FortiAnalyzer. FortiManager 8.0.0 and 7.6.0 through 7.6.7 should move to 8.0.1 or 7.6.8; the 7.4 and 7.2 branches have no fix and must migrate to a fixed release. This is the same management channel that attackers abused in late 2024 in the flaw known as FortiJump (CVE-2024-47575), so treat it seriously.
CVE-2026-126229 (FG-IR-26-244), rated critical at 9.1, lets a logged-in administrator reach other virtual domains (VDOMs), the separate partitions that many companies use to keep plant firewalls apart from office firewalls on the same console. CVE-2026-126184 (FG-IR-26-229), rated high at 8.2, needs no login and could disrupt the high availability (HA) pairing between redundant units. Fortinet also published several more FortiManager and FortiAnalyzer fixes the same day, covering memory corruption (heap buffer overflow), code injection and file path flaws. The common fix is FortiManager and FortiAnalyzer 8.0.2, 7.6.8 or 7.4.12, with the 7.2 branch moving to a fixed release for most of them.
At the plant, FortiGate firewalls often sit between the control network and the business network, or between a remote access zone and the control system. In the data center or the cloud, FortiManager and FortiAnalyzer hold the rule sets and logs for every one of those firewalls. A compromised console can change the rules on every site at once, so it deserves the same protection as a domain controller.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources: Fortinet PSIRT, 10 November 2026: FG-IR-26-267 https://www.fortiguard.com/psirt/FG-IR-26-267 ; FG-IR-26-275 https://www.fortiguard.com/psirt/FG-IR-26-275 ; FG-IR-26-244 https://www.fortiguard.com/psirt/FG-IR-26-244 ; FG-IR-26-229 https://www.fortiguard.com/psirt/FG-IR-26-229
Check out our resources and book a follow-up call with our team.
