FORTIANALYZER · CVE-2026-126171 · Vendor
FIX → 8.0.2 · 7.6.8 +2 ✓ verified
A format string flaw in Fortinet FortiAnalyzer and FortiManager lets an authenticated attacker run unauthorized commands through a specially crafted HTTP request. The NVD score is CVSS 7.2 (high), and the description covers many 7.2, 7.4, 7.6 and 8.0 builds of both products and their cloud editions.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running FortiAnalyzer or FortiManager, on-premises or Cloud, in the listed versions. The attacker must be authenticated and send a crafted HTTP request to the JSON-RPC (jrpc) API, so exposure depends on which accounts have RPC permission. Fortinet says the flaw is limited to the jrpc API. Fixed versions, or admin profiles with rpc-permit none, are not exposed through this path.
Not affected if auth-required, patched, rpc-permit-none, unpatched-ranges-not-in-use
Who cares fortianalyzer, fortimanager, fortinet, jrpc, self-hosted
A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized commands via specially crafted HTTP request
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.128.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12Upgrade to 8.0.2 · 7.6.8 +2
8.0.2, 7.6.8, 7.4.12 or 7.2.13 or above, per your branch