{"id":"CVE-2026-126170","kind":"vulnerability","aliases":["CVE-2026-126170"],"related":[],"title":"Fortinet FortiManager and FortiAnalyzer: unauthenticated crafted request to the JSON API can run commands","description":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request","summary":"Fortinet FG-IR-26-219 (CWE-116): a JSON injection in the JSON-RPC (JRPC) API of the GUI lets an unauthenticated attacker run unauthorized code or commands with a crafted HTTP request. Fortinet says the flaw exists only when the JSON API is enabled, which is off by default. Fortinet lists no known exploitation.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["7.6.8","8.0.3 (upcoming)"],"affected":">= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.2","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["7.6.8","8.0.3 (upcoming)"],"affected":">= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.2","ecosystem":"vendor"},{"name":"FortiAnalyzer-BigData","fixed":["7.6.3 (upcoming)"],"affected":">= 7.6.0, <= 7.6.2","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["7.6.8","8.0.3 (upcoming)"],"affected":">= 7.6.0, <= 7.6.7; >= 8.0.1, <= 8.0.2","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["7.6.8","8.0.3 (upcoming)"],"affected":">= 7.6.0, <= 7.6.7; >= 8.0.1, <= 8.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","json-api","self-hosted","vendor"],"not_affected_if":["default-config","json-api-disabled","version-7.2","version-7.4"],"how_to_check":"Check your version: affected are FortiManager/FortiAnalyzer (and Cloud) 7.6.0-7.6.7 and 8.0.0-8.0.2 (Cloud 8.0.1-8.0.2), FortiAnalyzer-BigData 7.6.0-7.6.2. 7.4 and 7.2 are not affected. Then check whether any admin profile has JSON API access: in the CLI run 'show system admin profile' and look for rpc-permit values other than none. Fortinet says the flaw exists only when the JSON API is enabled (disabled by default).","fix":"7.6: upgrade to 7.6.8 or above. 8.0: 8.0.3 is 'upcoming' per Fortinet (not yet released at publication); until then apply the workaround. FortiAnalyzer-BigData 7.6: upcoming 7.6.3. Workaround: config system admin profile / edit <profile name> / set rpc-permit none / end.","status":"open","published_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:31:01+00:00","updated_at":"2026-11-11T22:32:21+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:31:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Fortinet FortiAnalyzer and FortiManager: crafted HTTP request runs attacker commands","impact":"high","summary":"Several Fortinet FortiAnalyzer and FortiManager releases mishandle output encoding, so a specially crafted HTTP request may let an unauthenticated attacker run unauthorized code or commands. The sources rate it critical (CVSS 9.8).","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker runs unauthorized code or commands on the appliance","analyst_note":"Check Fortinet's PSIRT advisory for the fixed versions and any required settings, since the sources here give no fix and the reachable network exposure is unclear.","how_to_check":"- Check the running FortiAnalyzer, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiManager or FortiManager Cloud version against the affected ranges listed in the CVE description\n- unknown for any other check, the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The affected ranges are FortiAnalyzer 8.0.0 through 8.0.2 and 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2 and 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2 and 7.6.0 through 7.6.7, and FortiManager Cloud 8.0.1 through 8.0.2 and 7.6.0 through 7.6.7. The sources do not say which configurations or network exposures are needed, so exposure beyond the version range is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000849,"input_tokens":4753,"output_tokens":748,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check Fortinet's PSIRT advisory for the fixed versions and any required settings, since the sources here give no fix and the reachable network exposure is unclear.","search":"'-116':47B '-126170':17A,20A '-2026':16A,19A '-219':45B '26':44B '7.6.0':112C,122C,128C,136C,146C '7.6.2':130C '7.6.7':114C,124C,138C,148C '8.0.0':108C,132C '8.0.1':117C,141C '8.0.2':110C,119C,134C,143C 'allow':150C 'api':11A,35B,57B,84B 'attack':64B,153C 'bigdata':25A,127C 'cloud':27A,29A,116C,121C,140C,145C 'code':67B,157C 'command':14A,69B,159C 'craft':6A,72B,163C 'cve':15A,18A 'cwe':46B 'default':91B 'enabl':86B 'encod':99C 'escap':101C 'execut':155C 'exist':79B 'exploit':96B 'fg':42B 'fg-ir':41B 'flaw':78B 'fortianalyz':4A,30B,107C,111C,115C,120C,126C 'fortianalyzer':22A,24A,28A 'fortianalyzer-bigdata':23A,125C 'fortimanag':2A,31B,131C,135C,139C,144C 'fortimanager':21A,26A 'fortinet':1A,32B,40B,75B,92B,106C 'gui':60B 'host':38B 'http':73B,164C 'improp':98C 'inject':50B 'ir':43B 'jrpc':56B 'json':10A,34B,49B,54B,83B 'json-api':33B 'json-rpc':53B 'known':95B 'let':61B 'list':93B 'may':149C 'output':103C 'request':7A,74B,165C 'rpc':55B 'run':13A,65B 'say':76B 'self':37B 'self-host':36B 'special':162C 'unauthent':5A,63B,152C 'unauthor':66B,156C 'vendor':39B 'via':160C 'vulner':104C","nicknames":[],"mitigations":[],"who_affected":"Self-managed FortiManager and FortiAnalyzer appliances (and the Cloud and BigData variants) on 7.6.0-7.6.7 or 8.0.0-8.0.2 are exposed when an admin profile has the JSON API (rpc-permit) enabled; it is off by default. Fortinet also lists FortiSASE-Sovereign 25.x and 26.2 as affected (26.2 already remediated, migrate from 25.x). Teams on 7.4 or 7.2, or with the JSON API disabled, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:32:21Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219","run_id":3605},"products":{"at":"2026-11-11T22:32:21Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219","run_id":3605},"mitigations":{"at":"2026-11-11T22:32:21Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219","run_id":3605},"workarounds":{"at":"2026-11-11T22:32:21Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219","run_id":3605},"how_to_check":{"at":"2026-11-11T22:32:21Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219","run_id":3605},"who_affected":{"at":"2026-11-11T22:32:21Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219","run_id":3605}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzerbigdata","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["bigdata","cloud","fortianalyzer","fortimanager"],"labels":["critical","fortianalyzer","fortimanager","fortinet","jsonapi","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126170':17A,20A '-2026':16A,19A 'api':11A 'bigdata':25A 'cloud':27A,29A 'command':14A 'craft':6A 'cve':15A,18A 'fortianalyz':4A 'fortianalyzer':22A,24A,28A 'fortianalyzer-bigdata':23A 'fortimanag':2A 'fortimanager':21A,26A 'fortinet':1A 'json':10A 'request':7A 'run':13A 'unauthent':5A","search_b":"'-116':47B '-219':45B '26':44B 'api':35B,57B,84B 'attack':64B 'code':67B 'command':69B 'craft':72B 'cwe':46B 'default':91B 'enabl':86B 'exist':79B 'exploit':96B 'fg':42B 'fg-ir':41B 'flaw':78B 'fortianalyz':30B 'fortimanag':31B 'fortinet':32B,40B,75B,92B 'gui':60B 'host':38B 'http':73B 'inject':50B 'ir':43B 'jrpc':56B 'json':34B,49B,54B,83B 'json-api':33B 'json-rpc':53B 'known':95B 'let':61B 'list':93B 'request':74B 'rpc':55B 'run':65B 'say':76B 'self':37B 'self-host':36B 'unauthent':63B 'unauthor':66B 'vendor':39B","search_c":"'7.6.0':112C,122C,128C,136C,146C '7.6.2':130C '7.6.7':114C,124C,138C,148C '8.0.0':108C,132C '8.0.1':117C,141C '8.0.2':110C,119C,134C,143C 'allow':150C 'attack':153C 'bigdata':127C 'cloud':116C,121C,140C,145C 'code':157C 'command':159C 'craft':163C 'encod':99C 'escap':101C 'execut':155C 'fortianalyz':107C,111C,115C,120C,126C 'fortianalyzer-bigdata':125C 'fortimanag':131C,135C,139C,144C 'fortinet':106C 'http':164C 'improp':98C 'may':149C 'output':103C 'request':165C 'special':162C 'unauthent':152C 'unauthor':156C 'via':160C 'vulner':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126170","severity":null,"published_at":"2026-11-11T22:17:15+00:00","modified_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126170:3605","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219","severity":null,"published_at":"2026-11-11T22:32:21+00:00","modified_at":"2026-11-11T22:32:21+00:00","first_seen_at":"2026-11-11T22:32:21+00:00","fetched_at":"2026-11-11T22:32:21+00:00","note":"Read Fortinet PSIRT FG-IR-26-219: fix 7.6.8; 8.0.3 and BigData 7.6.3 upcoming; workaround rpc-permit none; JSON API off by default; not exploited. No PoC seen; social search skipped (tier B, just published).","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-219"]}],"documents":[{"id":129636,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219","title":"Fortinet PSIRT FG-IR-26-219: JSON Injection in JRPC API","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}