Back www.fortiguard.com

FG-IR-26-275

www.fortiguard.com • November 12, 2026

An improper authorization vulnerability in FortiManager FGFM may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets.

Internally discovered and reported by Theo Leleu of Fortinet Product Security team with the use of Frontier AI model: Claude Mythos.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in Fortinet Products Fortinet has disclosed several vulnerabilities affecting its products, including FortiOS, FortiMail, and FortiManager. An Authentication Bypass vulnerability in FortiOS (CWE-305) allows unauthenticated attackers to broadcast LSA via crafted requests, remediated in version 26.3.2. Two command injection vulnerabilities in FortiMail (CWE-77) and SQL injection vulnerabilities (CWE-89) were also reported, both of which were patched on October 5, 2026, in FortiMail Cloud. Additionally, an improper authorization vulnerability in FortiManager FGFM allows code execution via crafted packets. All affected customers do not need to take action as the issues have been remediated. These vulnerabilities were internally discovered by Fortinet's Product Security team using the AI model Claude Mythos. 30

Extracted Entities

FG-IR-26-275

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)