Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Remote Code Execution Without Login

Multiple critical vulnerabilities in Fortinet's FortiManager and FortiAnalyzer platforms—including a CVSS 9.8 JSON injection flaw enabling unauthenticated remote code execution—expose core network management infrastructure to full compromise without requiring any login credentials. The root cause lies in insufficient input validation and authorization enforcement within exposed APIs and services, compounding risk when these management interfaces are reachable from untrusted networks. Because FortiManager and FortiAnalyzer sit at the heart of enterprise network operations, a successful exploit could grant attackers administrative control over the entire managed environment. Fortinet has released patches, but organizations that delay updates or leave management APIs unnecessarily exposed remain critically vulnerable. This incident underscores that network security appliances must themselves be treated as high-value attack surfaces requiring rigorous patch discipline and access controls.