MS-ISAC advisory 2026-133, issued November 10, 2026, covers vulnerabilities across FortiOS, FortiManager, FortiAnalyzer and other Fortinet products. The most severe issues could allow arbitrary code execution. MS-ISAC reported no known exploitation in the wild at issuance; that statement does not guarantee that every deployment is safe.
The advisory includes authentication and authorization weaknesses, injection flaws, memory-safety issues and path traversal. Affected versions differ by product and vulnerability. Check each installed product and release branch against Fortinet's advisory tables rather than apply one upgrade version to the entire product family.
Two examples illustrate the different attack conditions. CVE-2025-61625 in FortiManager and FortiAnalyzer can let an authenticated user with read-only permissions write or delete underlying files through the JSON API. CVE-2026-26248 in FortiSandbox products is a cross-site scripting issue requiring social engineering and crafted requests. Fortinet marked both examples as not known exploited when checked.
Inventory affected appliances, management systems and cloud services, review the applicable Fortinet PSIRT advisories, then test and apply the supported fixes promptly. Confirm the installed versions after maintenance. Restrict administrative access, retain least-privilege accounts and network segmentation, and use vulnerability scanning to validate remediation. The two example advisories do not represent every issue in this release.
Sources: Fortinet PSIRT advisories; FortiManager and FortiAnalyzer JSON API flaw; FortiSandbox cross-site scripting flaw.
Attribution: MS-ISAC TLP:CLEAR advisory 2026-133, issued November 10, 2026. Example vendor advisories checked November 11, 2026 UTC.