{"id":"CVE-2026-126171","kind":"vulnerability","aliases":["CVE-2026-126171"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: format string flaw lets logged-in users run commands","description":"A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized commands via specially crafted HTTP request","summary":"A format string flaw in Fortinet FortiAnalyzer and FortiManager lets an authenticated attacker run unauthorized commands through a specially crafted HTTP request. The NVD score is CVSS 7.2 (high), and the description covers many 7.2, 7.4, 7.6 and 8.0 builds of both products and their cloud editions.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiManager","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":"7.2.1-7.2.12; 7.4.1-7.4.11; 7.6.0-7.6.7; 8.0.1","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":"7.2.1-7.2.12; 7.4.1-7.4.11; 7.6.0-7.6.7; 8.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","jrpc","self-hosted","vendor"],"not_affected_if":["auth-required","patched","rpc-permit-none","unpatched-ranges-not-in-use"],"how_to_check":"Check the version of FortiAnalyzer/FortiManager (CLI: get system status). Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12. Cloud editions: 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12. To limit exposure, check which admin profiles have rpc-permit set to anything other than none (config system admin profile).","fix":"Upgrade FortiAnalyzer and FortiManager (and their Cloud editions) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or above, per your branch. Workaround from Fortinet: the flaw is limited to the jrpc API, so disable it on admin profiles: config system admin profile; edit <profile>; set rpc-permit none; end.","status":"open","published_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:33:44+00:00","updated_at":"2026-11-11T22:46:31+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: format string flaw lets logged-in users run commands","impact":"high","summary":"A format string flaw in Fortinet FortiAnalyzer and FortiManager lets an authenticated attacker run unauthorized commands through a specially crafted HTTP request. The NVD score is CVSS 7.2 (high), and the description covers many 7.2, 7.4, 7.6 and 8.0 builds of both products and their cloud editions.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"logged-in attacker runs unauthorized commands on the appliance","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126171 to confirm the fixed versions and any workaround; NVD alone does not state a fix.","how_to_check":"- Check the installed FortiAnalyzer or FortiManager version in the admin console against the affected ranges listed in the source\n- For cloud editions, check the version shown in the Fortinet portal for the instance\n- unknown for any command-line check, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unpatched-ranges-not-in-use"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager (on-premises or Fortinet Cloud) in the affected version ranges are exposed. The attacker needs an account on the device, so exposure depends on who can log in to the management interface. unknown whether a non-default configuration is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000813,"input_tokens":4884,"output_tokens":650,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126171 to confirm the fixed versions and any workaround; NVD alone does not state a fix.","search":"'-126171':17A,20A '-2026':16A,19A '7.2':62B,69B '7.2.0':106C,140C '7.2.1':124C,158C '7.2.12':108C,126C,142C,160C '7.4':70B '7.4.0':102C,136C '7.4.1':119C,153C '7.4.11':104C,121C,138C,155C '7.6':71B '7.6.0':98C,114C,132C,148C '7.6.7':100C,116C,134C,150C '8.0':73B '8.0.0':94C,128C '8.0.1':96C,111C,130C,145C 'allow':162C 'attack':47B,165C 'authent':46B,164C 'build':74B 'cloud':24A,26A,80B,110C,113C,118C,123C,144C,147C,152C,157C 'command':14A,50B,169C 'control':87C 'cover':67B 'craft':54B,172C 'cve':15A,18A 'cvss':61B 'descript':66B 'edit':81B 'execut':167C 'extern':86C 'externally-control':85C 'flaw':7A,38B 'format':5A,36B,88C 'fortianalyz':2A,27B,41B,93C,97C,101C,105C,109C,112C,117C,122C 'fortianalyzer':21A,23A 'fortimanag':4A,28B,43B,127C,131C,135C,139C,143C,146C,151C,156C 'fortimanager':22A,25A 'fortinet':1A,29B,40B,92C 'high':63B 'host':33B 'http':55B,173C 'jrpc':30B 'let':8A,44B 'log':10A 'logged-in':9A 'mani':68B 'may':161C 'nvd':58B 'product':77B 'request':56B,174C 'run':13A,48B 'score':59B 'self':32B 'self-host':31B 'special':53B,171C 'string':6A,37B,89C 'unauthor':49B,168C 'use':83C 'user':12A 'vendor':34B 'via':170C 'vulner':90C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiAnalyzer or FortiManager, on-premises or Cloud, in the listed versions. The attacker must be authenticated and send a crafted HTTP request to the JSON-RPC (jrpc) API, so exposure depends on which accounts have RPC permission. Fortinet says the flaw is limited to the jrpc API. Fixed versions, or admin profiles with rpc-permit none, are not exposed through this path.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:46:31Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-220","run_id":3656},"products":{"at":"2026-11-11T22:46:31Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-220","run_id":3656},"how_to_check":{"at":"2026-11-11T22:46:31Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-220","run_id":3656},"who_affected":{"at":"2026-11-11T22:46:31Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-220","run_id":3656}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","jrpc","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126171':17A,20A '-2026':16A,19A 'cloud':24A,26A 'command':14A 'cve':15A,18A 'flaw':7A 'format':5A 'fortianalyz':2A 'fortianalyzer':21A,23A 'fortimanag':4A 'fortimanager':22A,25A 'fortinet':1A 'let':8A 'log':10A 'logged-in':9A 'run':13A 'string':6A 'user':12A","search_b":"'7.2':62B,69B '7.4':70B '7.6':71B '8.0':73B 'attack':47B 'authent':46B 'build':74B 'cloud':80B 'command':50B 'cover':67B 'craft':54B 'cvss':61B 'descript':66B 'edit':81B 'flaw':38B 'format':36B 'fortianalyz':27B,41B 'fortimanag':28B,43B 'fortinet':29B,40B 'high':63B 'host':33B 'http':55B 'jrpc':30B 'let':44B 'mani':68B 'nvd':58B 'product':77B 'request':56B 'run':48B 'score':59B 'self':32B 'self-host':31B 'special':53B 'string':37B 'unauthor':49B 'vendor':34B","search_c":"'7.2.0':106C,140C '7.2.1':124C,158C '7.2.12':108C,126C,142C,160C '7.4.0':102C,136C '7.4.1':119C,153C '7.4.11':104C,121C,138C,155C '7.6.0':98C,114C,132C,148C '7.6.7':100C,116C,134C,150C '8.0.0':94C,128C '8.0.1':96C,111C,130C,145C 'allow':162C 'attack':165C 'authent':164C 'cloud':110C,113C,118C,123C,144C,147C,152C,157C 'command':169C 'control':87C 'craft':172C 'execut':167C 'extern':86C 'externally-control':85C 'format':88C 'fortianalyz':93C,97C,101C,105C,109C,112C,117C,122C 'fortimanag':127C,131C,135C,139C,143C,146C,151C,156C 'fortinet':92C 'http':173C 'may':161C 'request':174C 'special':171C 'string':89C 'unauthor':168C 'use':83C 'via':170C 'vulner':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126171","severity":null,"published_at":"2026-11-11T22:17:15+00:00","modified_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126171:3656","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-220","severity":null,"published_at":"2026-11-11T22:46:31+00:00","modified_at":"2026-11-11T22:46:31+00:00","first_seen_at":"2026-11-11T22:46:31+00:00","fetched_at":"2026-11-11T22:46:31+00:00","note":"Read Fortinet PSIRT FG-IR-26-220 (CVE-2026-126171): fixed versions and jrpc workaround from vendor page. Not exploited per vendor. Sibling advisory FG-IR-26-245 is a separate format string flaw, not read in full. Vendor page lists impact as denial of service while text says command execution.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-220"]}],"documents":[{"id":129713,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-220","title":"Fortinet PSIRT FG-IR-26-220","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}