Fortinet Discloses 98 Flaws as UK, Canada Issue Advisories
The NHS advisory says 19 of the 98 vulnerabilities are critical, while Canada's cyber centre published version-specific update guidance.
Fortinet has disclosed 98 security vulnerabilities across its products, including the FortiOS firewall operating system and the FortiManager central management platform, according to dailysecu.com. The UK's NHS said in an advisory dated November 11 that 19 of the 98 flaws are critical severity.
Canada's Canadian Centre for Cyber Security issued guidance on November 12 covering the affected products and version-specific update criteria.
Among the notable flaws are CVE-2026-126170, rated CVSS 9.8, an SQL injection tracked as CVE-2026-126262 at 9.3, and an authentication bypass listed as CVE-2026-126253, also 9.3. FortiMail and FortiAnalyzer are among the other affected products.
Fixed versions by branch
For the 7.4 branch, the fixed releases are FortiOS 7.4.13 and FortiManager 7.4.12. On the 7.6 branch, both products require version 7.6.8.
Quick answers
Which Fortinet products are affected by the 98 vulnerabilities?
The disclosure covers FortiOS and FortiManager, and FortiMail and FortiAnalyzer are also among the affected products.
Which FortiOS and FortiManager versions fix the flaws?
FortiOS 7.4.13 and FortiManager 7.4.12 on the 7.4 branch; version 7.6.8 for both products on the 7.6 branch.
How many of the vulnerabilities are critical?
The NHS advisory states that 19 of the 98 vulnerabilities are critical severity.