Fortinet published advisory FG-IR-26-219 on 10 November 2026 for a JSON injection flaw in the management GUI of FortiManager, FortiAnalyzer and their cloud editions, tracked as CVE-2026-126170. An attacker who can reach the interface needs no credentials to run commands on the appliance.
What happened
The bug is an improper encoding or escaping of output issue (CWE-116) in the JSON-RPC API that sits behind the management GUI. A specially crafted HTTP request reaches the JRPC handler before authentication and is converted into unauthorised command execution with the privileges of the management process.
Fortinet says the JSON API is disabled by default, which limits the blast radius to deployments that switched it on, usually to integrate the appliance with automation or a SOC tooling stack. The company found the flaw internally, reports no exploitation in the wild, and has not published a virtual patch for it.
Who is affected
- FortiManager and FortiAnalyzer 7.6.0 through 7.6.7
- FortiManager and FortiAnalyzer 8.0.0 through 8.0.2, plus FortiManager Cloud and FortiAnalyzer Cloud on the same versions
- FortiAnalyzer-BigData 7.6.0 through 7.6.2 and FortiSASE-Sovereign 25.x deployments
- Any appliance whose admin profile permits JSON-RPC access, whether or not anyone remembers enabling it
What to do now
Upgrade to 7.6.8 where you can, and set rpc-permit none on every admin profile until 8.0.3 is released. The 8.0 branch has no fixed firmware yet, so the configuration change is the fix for those appliances.
- Enter config system admin profile, edit each profile, and set rpc-permit none; the workaround only means anything where the JSON API was enabled
- Keep the management interface on a management VLAN or behind a VPN and confirm it is not reachable from the internet
- Review the appliance logs for unauthenticated POSTs to the JRPC endpoint arriving from outside your own management ranges
- Record which admin profiles had JSON-RPC enabled before you disable it, so automation that depends on it can be rebuilt rather than silently broken
What this means for South African businesses
FortiManager holds the configuration, policy and credentials for every FortiGate a provider or a multi-branch group runs, so an unauthenticated command execution bug there is a whole-estate problem rather than a single-firewall problem. Few SMEs run FortiManager themselves, but the managed service provider looking after their firewalls very likely does.
The question worth asking a provider this week is not whether FortiManager is patched, but whether its management interface is reachable from anywhere other than the provider's own management network, because that reachability is the whole precondition for this flaw.
Source: Fortinet PSIRT advisory FG-IR-26-219.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.