---
id: "CVE-2026-126175"
page: "https://infrastack.ai/live/CVE-2026-126175"
kind: "vulnerability"
aliases: ["CVE-2026-126175"]
title: "Fortinet FortiAnalyzer and FortiManager: SQL injection lets logged-in users run commands"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAnalyzer", "fixed": ["7.6.8", "7.4.12"], "affected": "7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.2-7.2.12", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["7.6.8", "7.4.12"], "affected": "7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.2-7.2.13", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["7.6.8", "7.4.12"], "affected": "7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.2-7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["7.6.8", "7.4.12"], "affected": "7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.2-7.2.13", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "network-management", "vendor"]
not_affected_if: ["management-interface-restricted", "version-outside-range"]
published_at: "2026-11-11T22:17:15+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:46:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126175", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-221", "first_seen_at": "2026-11-11T22:46:19+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-221"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: SQL injection lets logged-in users run commands

Link for people: https://infrastack.ai/live/CVE-2026-126175 (this .md is for agents)

Fortinet's FortiAnalyzer and FortiManager management appliances contain an SQL injection flaw reachable through crafted JSON-RPC requests. An authenticated attacker can execute unauthorized code or commands on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.2-7.2.12 fixed 7.6.8, 7.4.12
- vendor:FortiAnalyzer Cloud affected 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.2-7.2.13 fixed 7.6.8, 7.4.12
- vendor:FortiManager affected 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.2-7.2.12 fixed 7.6.8, 7.4.12
- vendor:FortiManager Cloud affected 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.2-7.2.13 fixed 7.6.8, 7.4.12

## How to check

Check firmware version (System Information page, or CLI: get system status) on FortiAnalyzer/FortiManager (and Cloud editions). Affected: 7.6.0-7.6.7, 7.4.0-7.4.11 (Cloud 7.4.1-7.4.11), 7.2.2-7.2.12 (Cloud 7.2.2-7.2.13). 8.0 not affected. Fortinet lists no workaround and no virtual patch.

## Fix

FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud: 7.6.x upgrade to 7.6.8 or above; 7.4.x upgrade to 7.4.12 or above; 7.2.x has no 7.2 fix, migrate to a fixed release (7.4.12+ / 7.6.8+). 8.0 is not affected.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126175
- 2026-11-11T22:46:19+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-221 — Read Fortinet PSIRT FG-IR-26-221: fixes 7.6.8, 7.4.12; 7.2 has no 7.2.x fix (migrate to a fixed release); 8.0 not affected; no workaround or virtual patch; not known exploited.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-221 https://fortiguard.fortinet.com/psirt/FG-IR-26-221

## From the sources

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.2 through 7.2.12, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.2 through 7.2.13, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.2 through 7.2.12, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.2 through 7.2.13 may allow an authenticated attacker to execute unauthorized code or commands via crafted JSON-RPC requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_