Fortinet's 10 Nov feed lists 50 advisories, SecurityWeek counts 89; none of 17 pages read says exploited

Fifty advisories in the feed, 89 in the press: what each count rests on

Fortinet's public advisory feed, read between 16:06 and 16:25 UTC on Wednesday 11 November 2026, holds 50 advisories. All are dated 10 November 2026 and all say "Revised on 2026-11-10". Scored by the CVSSv3 number each one prints, 10 are 9.0 or higher, 39 are 7.0 to 8.9 and one is 5.9 (derived from the feed). SecurityWeek, in an article published at 12:10 UTC on 11 November, says Fortinet "dropped 89 new security advisories that address nearly 100 vulnerabilities across its products". The feed is therefore 56 per cent of the advisories SecurityWeek counts (50 of 89, derived), and it is not the whole batch: FG-IR-26-194, a critical FortiClient advisory published on 10 November, has its own page and is not in the feed.

What that does not establish is most of what a ticket needs. No page read gives a total number of CVEs for the batch. Nothing read shows that any of the flaws has been exploited: all 17 advisory pages read print "Known Exploited" as "No", and none of the 27 CVE identifiers printed on those pages and the listing page is in CISA's Known Exploited Vulnerabilities catalogue. The 34 feed advisories that were not opened one by one, and the advisories outside the feed, are not described here beyond the lines the feed prints for them.

What the feed, the listing and the pages hold

The feed is the FortiGuard advisory feed (the RSS file). Each item carries a title, a link to a PSIRT page, a CVSSv3 score, a one sentence description, a revised-on line and links to a CSAF and a CVRF file. It carries no product field, so products below are counted from the names in each description. A description that names three products counts for all three, which is why the product counts add to more than 50: 27 of the 50 descriptions name more than one product family (derived).

Zoom

Two things about the product counts. FortiAnalyzer-BigData is named in two descriptions and is not counted in the FortiAnalyzer row. And the largest groups, FortiManager and FortiAnalyzer, move together: 19 descriptions name exactly those two (with their cloud variants), and 14 of those 19 are scored 7.2 (derived). No description names FortiClient, FortiWeb or FortiSandbox, and FortiGate appears only as a managed device in FG-IR-26-225, a FortiManager flaw.

Fortinet's PSIRT listing page shows 15 rows on its first page, all "Published: Nov 10, 2026", all of them also in the feed. It prints "Total: 370" across 25 pages with no filter applied, which spans every year its filters offer (2022 to 2026), so 370 is not the November count. Fortinet's robots.txt says "Disallow: /?" for fortiguard.com and fortiguard.fortinet.com, so the later pages and the filtered views were not requested; every request to those hosts was spaced at least 2 seconds apart, as its Crawl-delay asks.

Where SecurityWeek and Fortinet's pages differ

The arithmetic behind "nearly 100" is not given. SecurityWeek's own severity counts, about 17 critical and nearly 80 high, add to roughly 97, so one reading is that "nearly 100" counts critical and high flaws only. That is this site's inference, not something SecurityWeek says. Against 89 advisories it would need around eight advisories to hold more than one flaw, whereas every page read holds one CVE identifier. The listing page prints the same identifier three times in one row (FG-IR-26-236), so a row can show several strings, but that one shows the same value each time.

The feed's own shape adds a second reason to doubt it is complete. Its advisory numbers run from FG-IR-26-190 to FG-IR-26-275, a span of 86 numbers; 50 are in the feed and 36 are not (derived), and FG-IR-26-194 is one of the 36. If every missing number were a November advisory the batch would be 86 plus any outside the span, against SecurityWeek's 89. That is arithmetic about numbering, not evidence that each number was published on 10 November. Separately, the feed's titles run in near alphabetical order, from "Allocation of resources without limits or throttling in fastapi" to "Incorrect authorization", with two exceptions and no title starting after the letter I (derived). That is consistent with a feed cut at 50 items from a title ordered list. Fortinet does not say how the feed is built, so it is an inference.

SecurityWeek also quotes Fortinet: "This ongoing effort complements the conventional methods we employ to identify and address vulnerabilities." and links Fortinet's 21 October post. That sentence is not in the copy of that post saved on 26 October for brief 453. Fortinet's robots.txt for www.fortinet.com carries "User-agent: *" with "Disallow: /", so this site did not request the current page, and the quotation rests on SecurityWeek. SecurityWeek also says the release comes "three weeks after" the announcement; 21 October to 10 November is 20 days (derived).

The ten highest scored advisories in the feed, read in full

All ten advisories scored 9.0 or more were opened on their PSIRT pages, along with seven others (17 pages in all, including FG-IR-26-194). The table gives each as the page prints it. Fortinet's own Severity word is "Critical" on all ten, and "Attack Type" is "Unauthenticated" on nine and "Authenticated" on one (FG-IR-26-244).

Across the ten: every page prints "Known Exploited" as "No", "Discovered" as "Internal" and "Virtual Patch" as "No". Nine credit Fortinet's Product Security team "with the use of" a frontier AI model and name it as Claude Mythos; FG-IR-26-200 says only "frontier AI models". Each of the five FortiMail pages says Fortinet remediated the issue on 5 October 2026 in FortiMail Cloud, 36 days before 10 November (derived), so FortiMail Cloud customers "need not perform any action" while on premise customers do. FG-IR-26-267 says the same for FortiSASE 26.3.1 and 26.3.1_a, remediated in 26.3.2.

Oddities in the record, as printed

None of these shows that a fix is wrong. They show where a script or a reader that trusts one field will be misled, and why the CSAF file and the advisory page should be read together.

Titles that name a component. The first item in the feed is "Allocation of resources without limits or throttling in fastapi", a FortiAuthenticator advisory (FG-IR-26-258) whose page names an API component. 12 of the 50 titles end in a component name or a cut off fragment (derived): fastapi, GUI, dmserver, releasecontrol, apache_mod, sshd, fortisoc, webmail, collectoragent, and FG-IR-26-225, whose feed title stops mid word at "a template engine i". No feed title contains a product name at all, so a title cannot be matched to a product without the description.

An impact field that disagrees with its own summary. FG-IR-26-207's summary describes obtaining an authenticated IBE webmail session as any recipient; its Impact field says "Denial of service". FG-IR-26-216's summary says an unauthenticated attacker may execute code or commands; its Impact field also says "Denial of service", and its CSAF vector scores availability impact as low (A:L). FG-IR-26-269's summary says an unauthenticated attacker may bypass authentication; its Impact field says "Denial of service". FG-IR-26-265's summary says authentication bypass; its Impact field says "Escalation of privilege". The pages do not explain the field.

A title and a weakness class that do not line up. FG-IR-26-269's title uses the wording of an output neutralisation weakness, while its summary names "a Path Traversal vulnerability [cwe-24]" in the ssh daemon of FortiOS, FortiSASE, FortiProxy and FortiPAM, and the page adds "The product is impacted only if GPC OS Login is enabled." Four feed descriptions print the weakness id in lower case (cwe-305, cwe-639, cwe-24, cwe-78). FG-IR-26-275 prints no weakness id on the feed or the page; its CVE record gives CWE-285.

Scores without vectors. The feed and the pages print a CVSSv3 score and no vector string. The CSAF files carry one (see Technical details), and the vector includes temporal metrics: for FG-IR-26-199 it ends "E:U/RL:O/RC:R". Four of the 17 pages also print a separate "CVSSv3 Temporal Score" (FG-IR-26-244, 255, 269 and 271). The score the feed prints is the base score. Nobody should compare the two without knowing which they hold.

Dates. Every feed item says "Revised on 2026-11-10", the same day as publication, and every page read lists one timeline entry, "2026-11-10: Initial publication". Nothing printed shows an earlier date for any advisory. One identifier looks older than its week: FG-IR-26-190 carries CVE-2025-61625, which the CVE record shows reserved on 29 September 2025 and published on 10 November 2026. Its page gives fixes from 7.6.5, 7.4.8 and 7.2.12, builds that predate the 22 October release.

CVE.org does not yet know most of the identifiers. The pages and the listing print 27 distinct CVE identifiers. Read at the CVE Program's record service on 11 November, four records exist (CVE-2025-61625, CVE-2026-121529, CVE-2026-121530 and CVE-2026-126261) and 23 answered that the record does not exist (derived). The four published records are dated from 20:10 UTC to 22:23 UTC on 10 November. That is a timing gap between Fortinet's pages and CVE.org, not a statement that the identifiers are wrong.

Exploitation: what Fortinet's pages and CISA's catalogue show

Fortinet's PSIRT pages carry a "Known Exploited" field, and it reads "No" on all 17 pages read, including all 10 critical advisories in the feed and FG-IR-26-194. The pages do not define the field. SecurityWeek reports the same absence of a mention. Neither says that attackers have not tried.

CISA's catalogue, version 2026.11.10 released at 19:03 UTC on 10 November 2026, holds 1,779 entries, 32 of them Fortinet's. The latest Fortinet addition is dated 16 October 2026 (CVE-2025-61624). None of the 27 identifiers above is in it (derived). The catalogue is keyed by CVE identifier, and it was released before the four CVE records that exist were published, so it could not yet have listed them. A newer catalogue release may differ from the copy read.

Brief 453 said what was coming; the feed shows this

Brief 453, read on 26 October, reported Fortinet's 21 October announcement: critical and high severity fixes for five product lines, FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, with advisories held to 10 November, and FortiSASE updated automatically. It could not say which product held a critical flaw, how many flaws there were or whether any was exploited. Here is how today's feed and pages compare, without judging either. The saved copy of Fortinet's post was the source for 453's side.

Zoom

Read plainly: the five lines 453 named all have advisories in the feed, each with at least one advisory at 9.0 or more (derived), so the claim that the release carried critical and high fixes is borne out for each line by the pages read. The advisory fixed versions on the pages read match the table that brief 453 reported in most rows, and a few advisories describe fixes that shipped earlier than that table: FG-IR-26-275, FG-IR-26-190 and FG-IR-26-195 name lower fixed versions, and FortiMail Cloud was fixed on 5 October. That bears on 453's remark that the FortiMail dates did not match the announcement. The advisories do not say which of the earlier builds carried which flaw.

453 also noted that Fortinet's June post promised to reference the source of each vulnerability. The pages read do this for 14 of 17: 13 name a frontier AI model and one says "frontier AI models". Two credit external reporters (FG-IR-26-194 and FG-IR-26-195) and one prints no acknowledgement at all (FG-IR-26-190). Fortinet does not say whether the AI testing found the flaw or the team confirmed it, and this site has not tested the claim.

What Fortinet's pages state, and what they do not

What to do, in order

Steps marked "Fortinet" come from the advisory pages themselves. Steps marked "this site's suggestion" are not Fortinet's advice.

Technical details

Fortinet's pages print no exploit detail, no payload, no indicators of compromise and no detection rules for any of these advisories, and none is given here. What they print is identifiers, weakness classes, version ranges, conditions and one workaround. Each block names the page it came from; the layout of a row (the bars) is this site's, and anything marked derived is this site's work.

First, the severity vectors. The feed and the pages print only a score, so these four come from the CSAF files that Fortinet's feed links. A defender can load the vector into a CVSS calculator to see which metrics drive the score.

FG-IR-26-199 | CVE-2026-126147 | CWE-22 | base score 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:R
FG-IR-26-216 | CVE-2026-126164 | CWE-89 | base score 9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
FG-IR-26-258 | CVE-2026-126244 | CWE-770 | base score 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
FG-IR-26-267 | CVE-2026-126253 | CWE-305 | base score 9.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H/E:P/RL:O/RC:C

Next, the fixed versions as printed in the "Solution" column of five pages, so a script can compare the version a device runs. FortiMail 7.2 and FortiAuthenticator rows follow the same wording.

FG-IR-26-267 | FortiOS 8.0 | 8.0.0 through 8.0.1 | Upgrade to 8.0.2 or above
FG-IR-26-267 | FortiOS 7.6 | 7.6.0 through 7.6.7 | Upgrade to 7.6.8 or above
FG-IR-26-267 | FortiOS 7.4 | 7.4.0 through 7.4.12 | Upgrade to 7.4.13 or above
FG-IR-26-267 | FortiOS 7.2 | 7.2.0 through 7.2.13 | Upgrade to 7.2.14 or above
FG-IR-26-244 | FortiManager 7.6 | 7.6.0 through 7.6.7 | Upgrade to 7.6.8 or above
FG-IR-26-244 | FortiManager 7.4 | 7.4.0 through 7.4.11 | Upgrade to 7.4.12 or above
FG-IR-26-244 | FortiManager 7.2 | 7.2 all versions | Migrate to a fixed release
FG-IR-26-275 | FortiManager 8.0 | 8.0.0 | Upgrade to 8.0.1 or above
FG-IR-26-275 | FortiManager 7.4 | 7.4.0 through 7.4.5 | Upgrade to 7.4.6 or above
FG-IR-26-275 | FortiManager 7.2 | 7.2.0 through 7.2.8 | Upgrade to 7.2.9 or above
FG-IR-26-199 | FortiMail 7.6 | 7.6.0 through 7.6.6 | Upgrade to 7.6.7 or above
FG-IR-26-199 | FortiMail 7.2 | 7.2 all versions | Migrate to a fixed release
FG-IR-26-265 | FortiAuthenticator 8.0 | 8.0.0 through 8.0.3 | Upgrade to 8.0.4 or above
FG-IR-26-265 | FortiAuthenticator 6.6 | 6.6.0 through 6.6.10 | Upgrade to 6.6.11 or above

Third, conditions and the FortiMail Cloud note, copied from the pages. A condition narrows who is exposed; it is not a fix. Use it to rank devices, and confirm it on the product before relying on it.

FG-IR-26-269: The product is impacted only if GPC OS Login is enabled.
FG-IR-26-255: Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).
FG-IR-26-194: Successful exploitation requires interaction with the victim.
FG-IR-26-271: ... bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access.
FG-IR-26-199: Please note that Fortinet has remediated this issue on Oct 05, 2026 in FortiMail Cloud by updating all the firmwares to v7.6.7 GA or v8.0.2 GA, hence the FortiMail Cloud customers need not perform any action.

Fourth, the one workaround on the pages read. FG-IR-26-195 (FortiOS, score 5.9) prints it for a RADIUS two factor flaw. It removes the Remote Radius Type administrator account that is linked to a RADIUS server answering with an extra "Access-Challenge". Deleting an administrator account can lock people out: keep a local administrator and a console route, and take a configuration backup before running it. The page says the same as the GUI path in the first line.

Navigate to System > Administrators and delete the Remote Radius Type administrator accounts.
config system admin
delete < Remote type administrator account >
next
end

Last, three commands this site derived to repeat the counts, none of them from Fortinet or CISA. The first counts distinct advisory ids in the feed (it printed 50 when read). The second asks the CVE Program for a record (it answered that the record does not exist for CVE-2026-126147 when read). The third lists the newest Fortinet entries in CISA's catalogue (the latest was 16 October 2026 when read). Run them with your own user agent string, and no more than once an hour.

curl -s -A "your-tool/1.0 (contact)" https://filestore.fortinet.com/fortiguard/rss/ir.xml | grep -o 'FG-IR-26-[0-9]*' | sort -u | wc -l
curl -s https://cveawg.mitre.org/api/cve/CVE-2026-126147
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | jq -r '.vulnerabilities[] | select(.vendorProject=="Fortinet") | .dateAdded + " " + .cveID + " " + .product' | sort -r | head -5

The question the count leaves open

If a vendor's own feed holds 50 advisories, its own listing holds a 51st that the feed omits, and the trade press counts 89, which number goes in your risk register, and who at the vendor will tell you the other 38?

Key facts