Fortinet's November fixes: FortiMail, FortiManager and FortiAuthenticator flaws that need no login

Fortinet put out 49 security advisories on November 10, and seven of the critical ones can be used by someone who never signs in. If you run FortiMail, FortiManager or FortiAuthenticator on your own hardware or VMs, plan the upgrade this week and close their management ports to the internet today.

These are the boxes attackers like best. A mail gateway reads every message coming in. FortiManager can push a policy to every firewall you own. FortiAuthenticatordefinitionFortinet's sign-in server. The VPN, Wi-Fi or firewall asks it whether a password and one-time code are right, over RADIUS, LDAP or SAML. decides who gets onto the VPN. Get root on any of them and you're most of the way into the company.

Nobody is known to be using these yet. That won't last long. Attackers read the fixed versions and work backwards to the bug, and Fortinet appliances have a long history on CISA's exploited list. FortiMail was there as recently as October 1, for CVE-2026-104286, a file-write flaw that needed no login. FortiManager's FGFMdefinitionHow FortiGates talk to FortiManager. A firewall registers over it and gets its configuration back. It listens on TCP port 541 unless someone changed it. port was the way in for CVE-2024-47575, which CISA listed in 2024.

The one thing that changes your risk is reach. Each of these flaws needs the attacker to get a packet to a specific port or page. A FortiManager whose port 541 only listens to your own firewalls is a much harder target than one on a public address. Find out which one you have before you decide how fast to move.

For engineers: the FortiMail pair are a path traversal (CWE-22, FG-IR-26-199) reached through the API and a command injection (CWE-77, FG-IR-26-200) in the HA join-request handler. FG-IR-26-216 is an SQL injection, and FG-IR-26-208 is an authorization bypass through a user-controlled key (CWE-639) that lets an outsider take over an IBEdefinitionIt's how FortiMail sends encrypted mail to people outside the company. They don't need any special software. They get an email, log in to a FortiMail web account and read the message there. recipient account. On FortiManager, FG-IR-26-275 is an authorization flaw in FGFM that Fortinet's title describes as elevation before the registration password is checked.

FortiAuthenticator's FG-IR-26-271 is a hard-coded password (CWE-259). Fortinet says it lets an unauthenticated attacker skip credential validation "in certain circumstances outside of the attacker's control." Read that as: it won't work every time, but you can't rely on luck either. The FortiOS OSPFdefinitionRouters use OSPF to tell each other which networks they can reach. Feed them a bad announcement and traffic goes the wrong way, or nowhere. flaw, FG-IR-26-267, lets an outsider inject route announcements. That only matters where OSPF runs on an interface someone untrusted can reach.

Read the table by product, not by row number. FortiAuthenticator numbers its releases differently, so its 6.6 line sits next to FortiMail's 7.x. The FortiMail HA flaw, FG-IR-26-200, only touches 7.6 and 8.0, and the same fixed versions cover it. FortiManager's VDOM flaw has its own, later fixed versions: 7.2.13, 7.4.12, 7.6.8 and 8.0.2. If you're patching FortiManager anyway, go straight to those.

Some lines get no fix at all. FortiMail 7.2 has to move for the mail flaws, and FortiOS 7.0 for the OSPF flaw. FortiManager and FortiAnalyzer 7.0 have to move for the VDOM flaw, and FortiAuthenticator 6.5 for a High-rated SQL injection. FortiPAM 1.0 through 1.6 has to move for a separate SSH flaw, FG-IR-26-269, rated High at 7.4, which Fortinet says only bites if GPC OS Login is enabled. If any of those are still in your estate, you're looking at a project with a change window and testing time, and it won't fit into a quick patch night.

Start with an honest list. Most companies know where their FortiGates are, and fewer know every FortiMail VM or the FortiAuthenticator someone set up for the VPN years ago. Patch in order of who can reach the box, and for each one write down whether it faces the internet.

# On FortiManager: refuse FGFM from devices it doesn't already manage
config system global
    set fgfm-deny-unknown enable
end
# Now try from a phone hotspot. A timeout is what you want to see
$ nc -vz -w 5 fmg.example.com 541
nc: connect to fmg.example.com port 541 (tcp) timed out. Good, strangers can't reach it

Fortinet's policy is to publish advisories on the second Tuesday of each month, with out-of-cycle alerts for critical bugs when needed. Teams that put that day in the calendar cope far better than teams who hear about it from a scanner.

Your firewall team or provider does the upgrades. We pick up the work around them. Our network security people take management ports off the internet and set up allow lists. Our identity and access team looks at what trusts FortiAuthenticator. If it sits between your VPN and Microsoft Entra ID or Okta, an Entra engineer can help you decide whether that MFA layer still earns its place. Not sure what else is exposed? Start with the free assessment.