Fortinet Vulnerabilities 2026: 223 CVEs So Far, and 99 of Them Landed on One Day After AI-Assisted Testing

As of November 12, 2026, Fortinet vulnerabilities 2026 total 223 Fortinet-assigned CVEs across 208 FortiGuard PSIRT advisories, already the most of any year since at least 2022. 99 of them (44%) arrived on November 10 alone, and 92 of those credit frontier AI models. CISA has added 9 Fortinet CVEs to its exploited list this year.

• 223 CVEs in Fortinet’s own advisories from January 1 to November 12, 2026, against 216 in all of 2025 and 109 in 2024.
• Through October, 2026 was running 31% below 2025: 124 CVEs against 180. The November 10 release alone added 99.
• 92 of the 99 November 10 CVEs credit discovery by Fortinet’s product security team using a frontier AI model. Of the 92 AI-credited CVEs in 2026, 90 name Claude Mythos and 1 names GPT-5.5 Cyber.
• 36 critical CVEs (CVSS 9.0 or higher) in 2026, up from 14 in all of 2025. 19 of the 36 came on November 10.
• FortiManager (61) and FortiAnalyzer (54) lead the 2026 count, ahead of FortiOS (32). 43 of FortiManager’s 61 arrived on November 10.
• 9 Fortinet CVEs joined CISA KEV in 2026, against 8 in 2025. Only 3 were listed within 2 days of the advisory; the median gap was 66 days.
• Fortinet’s own advisory says “exploited in the wild” for 4 of the 9. None of the 9 carries CISA’s known ransomware flag; 14 of Fortinet’s 32 KEV entries since 2021 do.

Figure 1. Fortinet CVEs by product and month, 2026 (January 1 to November 12)

Count of Fortinet-assigned CVEs by the date of their first FortiGuard advisory. A CVE that affects several products counts once in each product’s row, so rows add up to more than the 223 total shown under each month. “All other products” covers 5 smaller lines such as FortiAP, FortiDDoS, FortiNAC, FortiNDR and FortiFone. Red outline: at least one CVE in the cell is now in CISA KEV.

What changed most recently: the November 10 release

Fortinet’s October 21 blog post by CISO Carl Windsor said FortiOS, FortiManager and FortiAnalyzer updates would ship on October 22, after FortiMail and FortiAuthenticator updates on October 21, and that the fixes came from frontier AI-assisted security testing. It thanked Anthropic, OpenAI, Google and SpaceX. The advisories were held until the monthly PSIRT release on November 10, when the post was updated.

That release holds 89 advisories and 99 CVEs, the largest single Fortinet disclosure day in our data since 2021. 92 of the 99 CVEs carry an acknowledgment that the flaw was found internally by the Fortinet Product Security team “with the use of the frontier AI model”, naming Claude Mythos or GPT-5.5 Cyber. By product: FortiManager 43, FortiAnalyzer 38, FortiMail 27, FortiAuthenticator 18, FortiSASE 13 and FortiOS 8. 19 score 9.0 or higher, 8 of them in FortiMail.

The practical point: the fixed builds shipped on October 21 and 22, nearly three weeks before the CVE details. The post listed FortiOS 7.6.8, 7.4.13 and 7.2.14 and FortiManager and FortiAnalyzer 7.6.8, 7.4.12 and 7.2.13 as the fixed builds, so an MSP that moved to them in late October was ahead of the public details. Each advisory still names its own fixed version, which is the one to check. One of the 99 is not yet in NVD or the CVE.org list: CVE-2026-126260, a pre-authentication SSRF in FortiAnalyzer and FortiManager scored 9.0 in FG-IR-26-274, returned “record does not exist” from the CVE.org API on November 12.

Fortinet vulnerabilities by product, sortable

Click any column header to sort. FortiOS is the operating system on FortiGate firewalls, so the FortiOS row is the answer to “FortiGate vulnerability 2026”: 32 CVEs, 4 of them now in KEV. FortiSandbox had only 19 CVEs but 6 critical ones and 2 KEV entries. FortiClient EMS had 7 and 2 in KEV.

CVSS is the CVSS v3.1 base score in Fortinet’s advisory. Critical is 9.0 to 10, high 7.0 to 8.9. “KEV adds 2026” counts Fortinet CVEs CISA added in 2026 that affect the product, whatever year the advisory came out. FortiPAM and FortiSRA share advisories and are combined.

2026 month by month

In 2026 Fortinet’s scheduled advisories came on the second Tuesday of each month (August’s a day later, on the 12th), with out-of-band advisories for exploited flaws in between. The gap with 2025 opened in January: 7 CVEs against 55 in January 2025. March and April ran above 2025 (22 against 20, 28 against 11), but May to October added only 58 against 79. June had 3, the fewest. Then November 10 brought 99, more than any earlier month of 2026 by a factor of 3.5.

Figure 2. Fortinet CVEs per month in 2026, by CVSS severity

Four out-of-band advisories covered flaws that Fortinet says were exploited. FG-IR-26-060 on January 27 covered CVE-2026-24858, a FortiCloud single sign-on bypass across FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, FortiSwitch and FortiNAC, which Fortinet says was exploited by two malicious FortiCloud accounts it locked out on January 22. FG-IR-26-099 on Saturday April 4 covered FortiClient EMS (CVE-2026-35616). FG-IR-25-1142 on February 6 covered another FortiClient EMS flaw. FG-IR-26-175 on October 1 covered FortiMail (CVE-2026-104286), listed in KEV the same day.

2026 against 2022 to 2025

Fortinet’s annual CVE count alternates: 103 in 2022, 206 in 2023, 109 in 2024 and 216 in 2025. 2026 passed the 2025 total on November 10, with seven weeks left. The severity mix moved more than the count. The median CVSS score rose to 7.2 from 6.6, and critical CVEs went from 14 to 36.

Figure 3. Fortinet CVEs per year, January to October and the rest of the year

Figure 4. CVSS distribution of Fortinet CVEs, by year

Counts are Fortinet-assigned CVEs by first advisory date, so a CVE-2025 ID published in a 2026 advisory counts in 2026. KEV additions count by the date CISA added the entry. In 2025, Fortinet’s November advisories came after November 12, which is why the January to November 12 column matches January to October for that year.

Fortinet exploits in 2026: all 9 KEV additions

Only 3 of the 9 2026 KEV entries were listed within 2 days of Fortinet’s advisory. The other 6 came 37 to 239 days after a fix was public, which means attackers were using flaws that already had patches. The median gap was 66 days in 2026 against 1 day for the 7 entries CISA added in 2025 that tie to advisories since late 2021. CISA gave a 3 day federal deadline on 8 of the 9 and 14 days on CVE-2025-68686.

Figure 5. Days from FortiGuard advisory to CISA KEV listing, every Fortinet entry since November 2021

Fortinet’s own wording varies. Its advisories for CVE-2026-24858, CVE-2026-35616, CVE-2026-21643 and CVE-2026-104286 state in-the-wild exploitation. The current advisory text for the other five (the two FortiSandbox flaws, CVE-2025-68686, CVE-2025-25249 and CVE-2025-61624) does not, even though CISA lists them. CVE-2025-68686 is a bypass of a fix, so a FortiGate patched against the 2025 symlink issue was still exposed until it took the February 2026 build. The ransomware column is a lagging field: 14 of Fortinet’s 32 KEV entries carry “Known”, all of them added before 2026. Our comparison of the rate at which VPN gateway flaws end up in CISA’s catalog, which counts only gateway products, puts Fortinet first among VPN vendors by KEV entries. SonicWall shows a different pattern: its 2026 SonicWall advisories put every new KEV entry on one product line, SMA 1000, while Fortinet’s 9 are spread across 11 product families.

Every 2026 Fortinet CVE

All 223 rows, newest first, sortable. Red rows are in KEV. The download below adds NVD status, CWE, CVSS vector and KEV dates for 2021 to 2026.

Not counted: 8 third-party CVEs that FortiGuard advisories covered in 2026 (Linux kernel, OpenSSL, Apache HTTP Server, PHP, Node.js). They were assigned by other CNAs, so they are not Fortinet vulnerabilities in the CVE sense. FortiGuard also published an April 14 advisory on the compromised Axios npm package with no CVE.

• CVE-2025-15467 (OpenSSL), FG-IR-26-076, January 30, 2026
• CVE-2026-31431 (Linux kernel), FG-IR-26-139, May 13, 2026
• CVE-2026-43284 (Linux kernel), FG-IR-26-144, June 3, 2026
• CVE-2026-49975 (Apache HTTP Server), FG-IR-26-163, August 12, 2026
• CVE-2026-109618 (PHP), FG-IR-26-186, October 21, 2026
• CVE-2026-109619 (PHP), FG-IR-26-186, October 21, 2026
• CVE-2026-111497 (Node.js), FG-IR-26-187, October 26, 2026
• CVE-2026-98432 (Linux kernel), FG-IR-26-188, November 2, 2026

Is Fortinet getting rid of SSL-VPN?

What this means for MSPs

Confirm the October builds, not the November advisories. The fixed versions for the November 10 batch shipped on October 21 and 22. For every managed FortiGate, FortiManager and FortiAnalyzer, check the running build against FortiOS 7.6.8, 7.4.13 or 7.2.14 and FortiManager or FortiAnalyzer 7.6.8, 7.4.12 or 7.2.13 (8.0.2 on the 8.0 branch). FortiMail 7.2 has no fix in that release: Fortinet’s post says to move to 7.4 or later.

Do not let the CVE count set the order of work. 99 CVEs on one day is a reporting spike, not an exploitation spike: none of them is in KEV as of catalog 2026.11.10. The 9 that are in KEV include 6 that were listed 37 or more days after the fix, so the risk sits in boxes that missed older builds. Sort the product table by KEV and start with FortiSandbox, FortiClient EMS and FortiOS.

Management planes now carry the most CVEs. FortiManager and FortiAnalyzer account for 63 of the 223 2026 CVEs. Fortinet’s own post recommends limiting exposure by managing devices out of band. Keeping the FortiManager and FortiAnalyzer web and JSON-RPC interfaces reachable only from a management network also limits exposure to pre-authentication flaws such as CVE-2026-126260.

Plan the SSL-VPN migration before the FortiOS 7.6.3 upgrade. Tunnel-mode settings do not carry over, so a client upgraded without a migrated IPsec configuration loses remote access. Schedule the IPsec cutover and FortiClient profile push as one change.

Expect more large releases. Fortinet’s post describes AI-assisted testing as ongoing. If other vendors follow, monthly CVE volume will stop tracking risk; the KEV list and the vendor’s own exploitation wording are better triggers for out-of-hours patching. Our analysis of the KEV catalog covers those patterns across vendors.

Frequently asked questions

What is the latest Fortinet vulnerability?

The newest FortiGuard advisories are from November 10, 2026, when Fortinet published 89 advisories covering 99 of its own CVEs, 19 of them rated critical. The highest scores in that release are 9.8 for CVE-2026-126170 (JSON injection in the JSON-RPC API of FortiManager and FortiAnalyzer) and for CVE-2026-126147 and CVE-2026-126148 (FortiMail). The newest Fortinet entry in CISA KEV is CVE-2025-61624, added October 16, 2026.

How many Fortinet vulnerabilities were disclosed in 2026?

223 Fortinet-assigned CVEs in 208 FortiGuard advisories from January 1 to November 12, 2026, already more than any full year since at least 2022 (the previous high was 216 in 2025). Through October, though, 2026 had 124, 31% fewer than the 180 of January to October 2025. The November 10 release added 99.

Which Fortinet vulnerabilities are exploited in 2026?

CISA added 9 Fortinet CVEs to its Known Exploited Vulnerabilities catalog in 2026: CVE-2026-24858 (FortiCloud SSO, January 27), CVE-2026-35616 and CVE-2026-21643 (FortiClient EMS, April), CVE-2026-39808 and CVE-2026-25089 (FortiSandbox, July 16), CVE-2025-68686 (FortiOS SSL-VPN, July 27), CVE-2025-25249 (FortiOS and FortiSwitch, September 9), CVE-2026-104286 (FortiMail, October 1) and CVE-2025-61624 (October 16). None carries CISA’s known ransomware flag.

Is there a Fortinet VPN vulnerability in 2026?

Yes. CVE-2025-68686, published February 10, 2026, lets an unauthenticated attacker bypass Fortinet’s earlier fix for the SSL-VPN symlink persistence mechanism. CISA added it to KEV on July 27, 2026, 167 days after the advisory, with a 14 day deadline. Two other 2026 CVEs mention SSL-VPN: CVE-2026-23573 (July 14) and CVE-2026-121528 (November 10), neither in KEV.

Is Fortinet getting rid of SSL-VPN?

Partly. Fortinet’s FortiOS 7.6.3 release notes say SSL VPN tunnel mode is replaced with IPsec VPN, which can run over TCP port 443, on all FortiGate models, and that tunnel mode settings are not carried over on upgrade. Customers must migrate before upgrading. The web mode is renamed Agentless VPN and is not supported on FortiGate 40F, 60F and 90G models.

Was there a Fortinet vulnerability in June 2026?

Yes, 3 Fortinet CVEs were published on June 9, 2026, the quietest month of the year. One of them, CVE-2026-25089, a 9.8 FortiSandbox command injection, was added to CISA KEV on July 16, 2026, 37 days later.

Free to cite and republish with a link to this page.

Methodology

References

1. FortiGuard Labs, PSIRT Advisories and IR advisories RSS feed. Accessed November 2026.
2. FG-IR-26-274, FG-IR-26-060, FG-IR-26-099, FG-IR-25-1142, FG-IR-26-175, FG-IR-25-934, FG-IR-26-100, FG-IR-26-141, FG-IR-25-084 and FG-IR-26-122. Accessed November 2026.
3. Fortinet, Fortinet Releases Security Hardening Release for Multiple Products, October 21, 2026, updated November 10, 2026. Accessed November 2026.
4. Fortinet Document Library, FortiOS 7.6.3 release notes, SSL VPN tunnel mode replaced with IPsec VPN. Accessed November 2026.
5. CISA, Known Exploited Vulnerabilities Catalog. Accessed November 2026.
6. NIST NVD API 2.0, Fortinet CNA records. Accessed November 2026.
7. CVE.org API, CVE-2026-126260. Accessed November 2026.