Fortinet has released 89 security advisories covering nearly 100 vulnerabilities across its product portfolio, including approximately 17 critical-severity flaws and nearly 80 high-severity issues. The coordinated disclosure follows the company’s adoption of frontier AI models for product security testing and includes vulnerabilities affecting FortiMail, FortiAuthenticator, FortiOS, FortiManager, FortiAnalyzer, FortiSASE and FortiClient. SecurityWeek reported that Fortinet did not identify any of the newly disclosed flaws as exploited in the wild.
Several of the critical vulnerabilities could enable arbitrary code or command execution. Others involve authentication bypass, account takeover, access to other virtual domains, server-side request execution, malicious attribute delivery, webmail-session compromise, password resets and super-admin command execution. Fortinet’s PSIRT advisory database assigns CVE identifiers to individual issues, including CVE-2026-126259, which affects FortiOS and can permit unauthorized code or command execution.
The disclosures span both appliance and management products. Fortinet lists fixes such as FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14 or later for affected branches, while corresponding FortiManager and FortiAnalyzer fixes include 8.0.2, 7.6.8, 7.4.12 and 7.2.13 or later. FortiMail and FortiAuthenticator also received updates, and FortiSASE is being updated through the service. Administrators should consult each Fortinet advisory rather than infer exposure from the product name alone, because affected branches, prerequisites and remediation versions vary by flaw.
One FortiClient issue highlighted by researchers at Baldur Security is exploitable when FortiPAM is enabled. A malicious website can use a cross-origin resource-sharing misconfiguration to communicate with a local service and potentially execute arbitrary code on a victim’s system, according to the researcher cited by SecurityWeek. Fortinet also addressed high-severity bugs involving cross-site scripting, code injection, arbitrary file uploads, denial of service, man-in-the-middle attacks, privilege escalation, information disclosure and unauthorized access.
Fortinet said its AI-assisted program analyzes code paths, protocol handling and configuration logic alongside conventional fuzzing, manual review, penetration testing and red-team work. In an official security-hardening update, the company warned that AI can help attackers reverse-engineer patches and develop working exploits in hours or days rather than weeks, while also chaining lower-severity weaknesses. Defenders should therefore prioritize internet-facing Fortinet systems, apply the fixed releases identified in the PSIRT entries, review management and VPN exposure, and monitor for suspicious authentication, administrative and configuration activity while upgrades are planned.
