Summary
- Fortinet disclosed 98 vulnerabilities across several product families, including 19 rated critical.
- NHS England assesses exploitation as likely following publication of technical details, although confirmed exploitation of these flaws was not established in the advisory.
- Affected organisations should prioritise product-specific security updates, particularly for exposed appliances and management systems.
Organisations relying on Fortinet security infrastructure face an extensive patching exercise after the company disclosed 98 vulnerabilities across multiple product families, including 19 classified as critical.
Fortinet has issued advisories covering firewalls, management systems, authentication services, email security products, and other enterprise infrastructure.
NHS England’s National Cyber Security Operations Centre warned on 11 November that exploitation is likely following the publication of technical details, although its alert did not establish confirmed attacks exploiting the new disclosures.
The advisories follow security hardening updates made available in October. Fortinet released corrections before disclosing the full technical information, giving customers an opportunity to update systems before attackers could analyse the details.
Critical defects affect different products
The affected platforms include FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator, alongside other Fortinet technologies.
Reported weaknesses involve different classes of defect, including authentication bypass, improper authorisation, SQL injection, missing authentication checks, and inadequate output encoding.
Among the most significant is CVE-2026-126170, rated 9.8 on the CVSS 3.1 scale. Other highlighted issues include CVE-2026-126262 and CVE-2026-126253, each rated 9.3, and CVE-2026-126261 and CVE-2026-126259, each rated 9.0.
These vulnerabilities have different prerequisites and possible consequences. A product’s appearance in the broader advisory list does not mean that every version or configuration is susceptible to every reported issue.
Security teams must therefore compare the individual advisories with their actual software branches, enabled services, and deployment architecture rather than treat the disclosure as one universal appliance vulnerability.
Security infrastructure creates concentrated exposure
Firewalls and identity systems enforce important network boundaries and may process sensitive traffic or hold configuration information. Management platforms can have access to numerous devices within a single enterprise estate.
A compromise affecting such systems may have consequences beyond one server, depending on the permissions attached to the affected component and its connections to other infrastructure.
Some security appliances are also deployed at network boundaries, where particular services may be reachable from external or less-trusted networks.
Exposure depends on the product, the configuration, and the network environment. A critical CVSS score alone cannot establish that every installation is internet-accessible or immediately exploitable.
Public detail changes remediation urgency
Fortinet’s earlier distribution of fixes gave administrators time to reduce exposure before complete descriptions were made available.
Following detailed disclosure, attackers may compare patched and unpatched software and investigate which changes address security weaknesses. That possibility underlies NHS England’s assessment that exploitation is likely.
The warning is a risk judgement, not confirmation that all 98 vulnerabilities have already been exploited. The Multi-State Information Sharing and Analysis Center separately reported no known exploitation in the wild at the time of its 11 November advisory.
Organisations reviewing the incident should distinguish evidence of actual malicious activity from general exposure to newly documented weaknesses.
Fixes vary by release branch
NHS England identifies affected FortiOS branches preceding versions 8.0.2, 7.6.8, 7.4.13, and 7.2.14, while the other product families have different affected-version ranges.
These branch thresholds do not constitute a single fix for every vulnerability. Each applicable Fortinet PSIRT advisory identifies the affected configuration and recommended version.
Administrators should inventory relevant appliances, establish installed software versions, and verify whether the October hardening updates were successfully applied.
Priority may depend on whether vulnerable interfaces are reachable from untrusted networks, the privileges available through the component, and the operational importance of the service.
Maintenance can require coordination because some appliances provide essential connectivity or authentication services. Where immediate updates cannot be installed, supported exposure-reduction measures may help until a maintenance window is available.
After remediation, teams should verify the corrected version and confirm that security functions remain operational.
Fortinet maintains its security advisories through the FortiGuard PSIRT portal.
The newly disclosed flaws create a substantial maintenance requirement for businesses using Fortinet systems. The extent of risk will depend on which products they operate, their actual exposure, and how quickly applicable fixes are installed.
