FORTIMANAGER · CVE-2026-126176 · Vendor
FIX → 7.6.8 ✓ verified
Fortinet FortiAnalyzer and FortiManager, including their cloud versions, mishandle crafted SAML requests so an unauthenticated remote attacker can inject arbitrary content into a signed SAML response. The sources describe this as an XML injection (blind XPath injection) issue with a CVSS score of 8.1, but they do not state what the attacker can read or change beyond that.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-managed FortiAnalyzer or FortiManager, or their Cloud editions, in the version ranges Fortinet lists. The flaw is reachable by an unauthenticated remote attacker through crafted SAML requests to the API. Fortinet does not say whether SAML must be enabled, so no one in the ranges can skip it on that basis. Versions at or above the fixed releases are not affected.
Not affected if unaffected-version
Who cares fortianalyzer, fortimanager, fortinet, saml, self-hosted
get system status on the FortiAnalyzer/FortiManager CLI (or check the dashboard) and compare the version with the affected ranges: 8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.11; A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
7.2.0-7.2.128.0.0; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12Upgrade to 7.6.8
Upgrade FortiAnalyzer/FortiManager (and Cloud) to 8.0.1, 7.6.8, 7.4.12 or 7.2.13 or later, per branch.