{"id":"CVE-2026-126175","kind":"vulnerability","aliases":["CVE-2026-126175"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: SQL injection lets logged-in users run commands","description":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.2 through 7.2.12, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.2 through 7.2.13, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.2 through 7.2.12, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.2 through 7.2.13 may allow an authenticated attacker to execute unauthorized code or commands via crafted JSON-RPC requests.","summary":"Fortinet's FortiAnalyzer and FortiManager management appliances contain an SQL injection flaw reachable through crafted JSON-RPC requests. An authenticated attacker can execute unauthorized code or commands on the device.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["7.6.8","7.4.12"],"affected":"7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.2-7.2.12","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["7.6.8","7.4.12"],"affected":"7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.2-7.2.13","ecosystem":"vendor"},{"name":"FortiManager","fixed":["7.6.8","7.4.12"],"affected":"7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.2-7.2.12","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["7.6.8","7.4.12"],"affected":"7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.2-7.2.13","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","network-management","vendor"],"not_affected_if":["management-interface-restricted","version-outside-range"],"how_to_check":"Check firmware version (System Information page, or CLI: get system status) on FortiAnalyzer/FortiManager (and Cloud editions). Affected: 7.6.0-7.6.7, 7.4.0-7.4.11 (Cloud 7.4.1-7.4.11), 7.2.2-7.2.12 (Cloud 7.2.2-7.2.13). 8.0 not affected. Fortinet lists no workaround and no virtual patch.","fix":"FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud: 7.6.x upgrade to 7.6.8 or above; 7.4.x upgrade to 7.4.12 or above; 7.2.x has no 7.2 fix, migrate to a fixed release (7.4.12+ / 7.6.8+). 8.0 is not affected.","status":"open","published_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:31:19+00:00","updated_at":"2026-11-11T22:46:19+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:31:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: SQL injection lets logged-in users run commands","impact":"high","summary":"Fortinet's FortiAnalyzer and FortiManager management appliances contain an SQL injection flaw reachable through crafted JSON-RPC requests. An authenticated attacker can execute unauthorized code or commands on the device.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","network-management"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker executes unauthorized commands on the management appliance","analyst_note":"Fixed versions and vendor advisory are not in the sources; check the Fortinet PSIRT advisory for CVE-2026-126175 to confirm the fixed release and any workaround.","how_to_check":"- Identify FortiAnalyzer, FortiAnalyzer Cloud, FortiManager or FortiManager Cloud in your environment and note the firmware version, for example via the device's System Information page\n- Compare the running version against the affected ranges: 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.2 through 7.2.12 (7.2.13 for the Cloud editions)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range","management-interface-restricted"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager, on-premises or in the Cloud editions, within the listed version ranges. The attacker must hold valid credentials on the device, so exposure is reduced where access to the management interface is restricted to trusted administrators. Systems outside these product lines are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000814,"input_tokens":4811,"output_tokens":665,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed versions and vendor advisory are not in the sources; check the Fortinet PSIRT advisory for CVE-2026-126175 to confirm the fixed release and any workaround.","search":"'-126175':16A,19A '-2026':15A,18A '7.2.12':91C,118C '7.2.13':106C,133C '7.2.2':89C,104C,116C,131C '7.4.0':85C,112C '7.4.1':99C,126C '7.4.11':87C,101C,114C,128C '7.6.0':81C,94C,108C,121C '7.6.7':83C,96C,110C,123C 'allow':135C 'applianc':39B 'attack':54B,138C 'authent':53B,137C 'cloud':22A,25A,93C,98C,103C,120C,125C,130C 'code':58B,142C 'command':13A,60B,74C,144C 'contain':40B 'craft':47B,146C 'cve':14A,17A 'devic':63B 'element':69C 'execut':56B,140C 'flaw':44B 'fortianalyz':2A,26B,35B,80C,84C,88C,92C,97C,102C 'fortianalyzer':20A,21A 'fortimanag':4A,27B,37B,107C,111C,115C,119C,124C,129C 'fortimanager':23A,24A 'fortinet':1A,28B,33B,79C 'improp':65C 'inject':6A,43B,76C 'json':49B,148C 'json-rpc':48B,147C 'let':7A 'log':9A 'logged-in':8A 'manag':31B,38B 'may':134C 'network':30B 'network-manag':29B 'neutral':66C 'reachabl':45B 'request':51B,150C 'rpc':50B,149C 'run':12A 'special':68C 'sql':5A,42B,73C,75C 'unauthor':57B,141C 'use':70C 'user':11A 'vendor':32B 'via':145C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiAnalyzer or FortiManager, on-premises or Cloud editions, in the listed 7.2, 7.4 or 7.6 ranges. An attacker needs a valid authenticated account and sends crafted JSON-RPC requests to the API to run code or commands. Version 8.0 is not affected. Restricting management access to trusted admins reduces exposure but is not a vendor-stated fix.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:46:19Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-221","run_id":3655},"products":{"at":"2026-11-11T22:46:19Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-221","run_id":3655},"how_to_check":{"at":"2026-11-11T22:46:19Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-221","run_id":3655},"who_affected":{"at":"2026-11-11T22:46:19Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-221","run_id":3655}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","networkmanagement","vendor"],"campaign_type":null,"search_a":"'-126175':16A,19A '-2026':15A,18A 'cloud':22A,25A 'command':13A 'cve':14A,17A 'fortianalyz':2A 'fortianalyzer':20A,21A 'fortimanag':4A 'fortimanager':23A,24A 'fortinet':1A 'inject':6A 'let':7A 'log':9A 'logged-in':8A 'run':12A 'sql':5A 'user':11A","search_b":"'applianc':39B 'attack':54B 'authent':53B 'code':58B 'command':60B 'contain':40B 'craft':47B 'devic':63B 'execut':56B 'flaw':44B 'fortianalyz':26B,35B 'fortimanag':27B,37B 'fortinet':28B,33B 'inject':43B 'json':49B 'json-rpc':48B 'manag':31B,38B 'network':30B 'network-manag':29B 'reachabl':45B 'request':51B 'rpc':50B 'sql':42B 'unauthor':57B 'vendor':32B","search_c":"'7.2.12':91C,118C '7.2.13':106C,133C '7.2.2':89C,104C,116C,131C '7.4.0':85C,112C '7.4.1':99C,126C '7.4.11':87C,101C,114C,128C '7.6.0':81C,94C,108C,121C '7.6.7':83C,96C,110C,123C 'allow':135C 'attack':138C 'authent':137C 'cloud':93C,98C,103C,120C,125C,130C 'code':142C 'command':74C,144C 'craft':146C 'element':69C 'execut':140C 'fortianalyz':80C,84C,88C,92C,97C,102C 'fortimanag':107C,111C,115C,119C,124C,129C 'fortinet':79C 'improp':65C 'inject':76C 'json':148C 'json-rpc':147C 'may':134C 'neutral':66C 'request':150C 'rpc':149C 'special':68C 'sql':73C,75C 'unauthor':141C 'use':70C 'via':145C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126175","severity":null,"published_at":"2026-11-11T22:17:15+00:00","modified_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126175:3655","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-221","severity":null,"published_at":"2026-11-11T22:46:19+00:00","modified_at":"2026-11-11T22:46:19+00:00","first_seen_at":"2026-11-11T22:46:19+00:00","fetched_at":"2026-11-11T22:46:19+00:00","note":"Read Fortinet PSIRT FG-IR-26-221: fixes 7.6.8, 7.4.12; 7.2 has no 7.2.x fix (migrate to a fixed release); 8.0 not affected; no workaround or virtual patch; not known exploited.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-221"]}],"documents":[{"id":129712,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-221","title":"Fortinet PSIRT FG-IR-26-221","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}