---
id: "CVE-2026-126170"
page: "https://infrastack.ai/live/CVE-2026-126170"
kind: "vulnerability"
aliases: ["CVE-2026-126170"]
title: "Fortinet FortiManager and FortiAnalyzer: unauthenticated crafted request to the JSON API can run commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiManager", "fixed": ["7.6.8", "8.0.3 (upcoming)"], "affected": ">= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.2", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["7.6.8", "8.0.3 (upcoming)"], "affected": ">= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.2", "ecosystem": "vendor"}, {"name": "FortiAnalyzer-BigData", "fixed": ["7.6.3 (upcoming)"], "affected": ">= 7.6.0, <= 7.6.2", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["7.6.8", "8.0.3 (upcoming)"], "affected": ">= 7.6.0, <= 7.6.7; >= 8.0.1, <= 8.0.2", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["7.6.8", "8.0.3 (upcoming)"], "affected": ">= 7.6.0, <= 7.6.7; >= 8.0.1, <= 8.0.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "json-api", "self-hosted", "vendor"]
not_affected_if: ["default-config", "json-api-disabled", "version-7.2", "version-7.4"]
published_at: "2026-11-11T22:17:15+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:32:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126170", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-219", "first_seen_at": "2026-11-11T22:32:21+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-219"]}]
exploit_sources: []
---

# Fortinet FortiManager and FortiAnalyzer: unauthenticated crafted request to the JSON API can run commands

Link for people: https://infrastack.ai/live/CVE-2026-126170 (this .md is for agents)

Fortinet FG-IR-26-219 (CWE-116): a JSON injection in the JSON-RPC (JRPC) API of the GUI lets an unauthenticated attacker run unauthorized code or commands with a crafted HTTP request. Fortinet says the flaw exists only when the JSON API is enabled, which is off by default. Fortinet lists no known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.2 fixed 7.6.8, 8.0.3 (upcoming)
- vendor:FortiAnalyzer affected >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.2 fixed 7.6.8, 8.0.3 (upcoming)
- vendor:FortiAnalyzer-BigData affected >= 7.6.0, <= 7.6.2 fixed 7.6.3 (upcoming)
- vendor:FortiManager Cloud affected >= 7.6.0, <= 7.6.7; >= 8.0.1, <= 8.0.2 fixed 7.6.8, 8.0.3 (upcoming)
- vendor:FortiAnalyzer Cloud affected >= 7.6.0, <= 7.6.7; >= 8.0.1, <= 8.0.2 fixed 7.6.8, 8.0.3 (upcoming)

## How to check

Check your version: affected are FortiManager/FortiAnalyzer (and Cloud) 7.6.0-7.6.7 and 8.0.0-8.0.2 (Cloud 8.0.1-8.0.2), FortiAnalyzer-BigData 7.6.0-7.6.2. 7.4 and 7.2 are not affected. Then check whether any admin profile has JSON API access: in the CLI run 'show system admin profile' and look for rpc-permit values other than none. Fortinet says the flaw exists only when the JSON API is enabled (disabled by default).

## Fix

7.6: upgrade to 7.6.8 or above. 8.0: 8.0.3 is 'upcoming' per Fortinet (not yet released at publication); until then apply the workaround. FortiAnalyzer-BigData 7.6: upcoming 7.6.3. Workaround: config system admin profile / edit <profile name> / set rpc-permit none / end.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126170
- 2026-11-11T22:32:21+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-219 — Read Fortinet PSIRT FG-IR-26-219: fix 7.6.8; 8.0.3 and BigData 7.6.3 upcoming; workaround rpc-permit none; JSON API off by default; not exploited. No PoC seen; social search skipped (tier B, just published).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-219: JSON Injection in JRPC API https://fortiguard.fortinet.com/psirt/FG-IR-26-219

## From the sources

A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_