Back fortiguard.fortinet.com

FG IR 26 191

fortiguard.fortinet.com • November 11, 2026

A URL redirection to untrusted site ('open redirect') vulnerability [CWE-601] in FortiAuthenticator may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.

2026-11-10: Initial publication

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fortinet Patches Nearly 100 Vulnerabilities, 17 Critical Flaws Identified On November 10, 2026, Fortinet disclosed 89 new security advisories addressing nearly 100 vulnerabilities across its product line, including FortiOS, FortiManager, and FortiAnalyzer. Among these, 17 vulnerabilities are classified as critical, with several allowing for arbitrary code execution. The vulnerabilities stem from various issues, including SQL injection, improper authorization, and command injection. Fortinet has integrated frontier AI models into its security testing, which reportedly helped identify these flaws. No evidence of these vulnerabilities being exploited in the wild has been reported. The company urges customers to prioritize applying the patches due to the potential for rapid exploitation. The critical vulnerabilities include CVE-2026-104286, which was previously flagged by CISA as. Affected systems include FortiMail, FortiAuthenticator, and FortiClient, among others. 4 sources 58

FG IR 26 191

The full story

Extracted Entities

CWE Weaknesses (1)

Vulnerabilities (1)