---
id: "CVE-2026-126171"
page: "https://infrastack.ai/live/CVE-2026-126171"
kind: "vulnerability"
aliases: ["CVE-2026-126171"]
title: "Fortinet FortiAnalyzer and FortiManager: format string flaw lets logged-in users run commands"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAnalyzer", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": "7.2.1-7.2.12; 7.4.1-7.4.11; 7.6.0-7.6.7; 8.0.1", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": "7.2.1-7.2.12; 7.4.1-7.4.11; 7.6.0-7.6.7; 8.0.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "jrpc", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "patched", "rpc-permit-none", "unpatched-ranges-not-in-use"]
published_at: "2026-11-11T22:17:15+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:46:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126171", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-220", "first_seen_at": "2026-11-11T22:46:31+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-220"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: format string flaw lets logged-in users run commands

Link for people: https://infrastack.ai/live/CVE-2026-126171 (this .md is for agents)

A format string flaw in Fortinet FortiAnalyzer and FortiManager lets an authenticated attacker run unauthorized commands through a specially crafted HTTP request. The NVD score is CVSS 7.2 (high), and the description covers many 7.2, 7.4, 7.6 and 8.0 builds of both products and their cloud editions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected >= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2
- vendor:FortiManager affected >= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2
- vendor:FortiAnalyzer Cloud affected 7.2.1-7.2.12; 7.4.1-7.4.11; 7.6.0-7.6.7; 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2
- vendor:FortiManager Cloud affected 7.2.1-7.2.12; 7.4.1-7.4.11; 7.6.0-7.6.7; 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2

## How to check

Check the version of FortiAnalyzer/FortiManager (CLI: get system status). Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12. Cloud editions: 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12. To limit exposure, check which admin profiles have rpc-permit set to anything other than none (config system admin profile).

## Fix

Upgrade FortiAnalyzer and FortiManager (and their Cloud editions) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or above, per your branch. Workaround from Fortinet: the flaw is limited to the jrpc API, so disable it on admin profiles: config system admin profile; edit <profile>; set rpc-permit none; end.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126171
- 2026-11-11T22:46:31+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-220 — Read Fortinet PSIRT FG-IR-26-220 (CVE-2026-126171): fixed versions and jrpc workaround from vendor page. Not exploited per vendor. Sibling advisory FG-IR-26-245 is a separate format string flaw, not read in full. Vendor page lists impact as denial of service while text says command execution.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-220 https://fortiguard.fortinet.com/psirt/FG-IR-26-220

## From the sources

A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized commands via specially crafted HTTP request

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_