{"id":"CVE-2026-126176","kind":"vulnerability","aliases":["CVE-2026-126176"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: crafted SAML requests can inject content into signed responses","description":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests.","summary":"Fortinet FortiAnalyzer and FortiManager, including their cloud versions, mishandle crafted SAML requests so an unauthenticated remote attacker can inject arbitrary content into a signed SAML response. The sources describe this as an XML injection (blind XPath injection) issue with a CVSS score of 8.1, but they do not state what the attacker can read or change beyond that.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["7.6.8"],"affected":">= 7.6.0, < 7.6.8","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["7.6.8"],"affected":">= 7.6.0, < 7.6.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","saml","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"Run 'get system status' on the FortiAnalyzer/FortiManager CLI (or check the dashboard) and compare the version with the affected ranges: 8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12. Cloud variants: 8.0.0; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12. Fortinet's advisory does not say whether SAML SSO must be configured for exposure, so treat any device in these ranges as exposed until patched. It lists no workaround and no virtual patch.","fix":"Upgrade FortiAnalyzer/FortiManager (and Cloud) to 8.0.1, 7.6.8, 7.4.12 or 7.2.13 or later, per branch.","status":"open","published_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:31:46+00:00","updated_at":"2026-11-11T22:45:28+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:31:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Fortinet FortiAnalyzer and FortiManager: crafted SAML requests can inject content into signed responses","impact":"medium","summary":"Fortinet FortiAnalyzer and FortiManager, including their cloud versions, mishandle crafted SAML requests so an unauthenticated remote attacker can inject arbitrary content into a signed SAML response. The sources describe this as an XML injection (blind XPath injection) issue with a CVSS score of 8.1, but they do not state what the attacker can read or change beyond that.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","saml","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker injects content into signed SAML responses","analyst_note":"Find Fortinet's advisory for CVE-2026-126176 to confirm the fixed versions, the workaround, and whether SAML must be enabled for exposure.","how_to_check":"- Check the installed FortiAnalyzer or FortiManager version against the affected ranges listed in the NVD entry (for example 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and 8.0.0).\n- Check whether SAML single sign-on is enabled on the device; the sources do not say whether it is required for exposure.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"The affected products are Fortinet FortiAnalyzer and FortiManager, both on-premises and in the cloud, in the listed version ranges. The sources do not say which configurations are exposed, so the SAML setting is the first thing to verify. Teams not running these products can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000839,"input_tokens":4894,"output_tokens":700,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Fortinet's advisory for CVE-2026-126176 to confirm the fixed versions, the workaround, and whether SAML must be enabled for exposure.","search":"'-126176':16A,19A '-2026':15A,18A '7.2.0':108C,140C '7.2.1':126C,158C '7.2.12':110C,128C,142C,160C '7.4.0':104C,136C '7.4.1':121C,153C '7.4.11':106C,123C,138C,155C '7.6.0':100C,116C,132C,148C '7.6.7':102C,118C,134C,150C '8.0.0':98C,113C,130C,145C '8.1':73B 'aka':90C 'allow':162C 'arbitari':169C 'arbitrari':49B 'attack':46B,81B,166C 'beyond':86B 'blind':64B,91C 'chang':85B 'cloud':36B,112C,115C,120C,125C,144C,147C,152C,157C 'content':10A,50B,170C 'craft':5A,39B,177C 'cve':14A,17A 'cvss':70B 'describ':58B 'fortianalyz':2A,22B,31B,97C,99C,103C,107C,111C,114C,119C,124C 'fortianalyzer':21A 'fortimanag':4A,23B,33B,129C,131C,135C,139C,143C,146C,151C,156C 'fortimanager':20A 'fortinet':1A,24B,30B,96C 'host':28B 'includ':34B 'inject':9A,48B,63B,66B,89C,93C,168C 'issu':67B 'may':161C 'mishandl':38B 'read':83B 'remot':45B,165C 'request':7A,41B,179C 'respons':13A,55B,175C 'saml':6A,25B,40B,54B,174C,178C 'score':71B 'self':27B 'self-host':26B 'sign':12A,53B,173C 'sourc':57B 'state':78B 'unauthent':44B,164C 'vendor':29B 'version':37B 'via':176C 'vulner':94C 'xml':62B,88C 'xpath':65B,92C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed FortiAnalyzer or FortiManager, or their Cloud editions, in the version ranges Fortinet lists. The flaw is reachable by an unauthenticated remote attacker through crafted SAML requests to the API. Fortinet does not say whether SAML must be enabled, so no one in the ranges can skip it on that basis. Versions at or above the fixed releases are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:45:28Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222","run_id":3654},"products":{"at":"2026-11-11T22:45:28Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222","run_id":3654},"how_to_check":{"at":"2026-11-11T22:45:28Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222","run_id":3654}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortianalyzer","fortimanager"],"ptokens":["fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","saml","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126176':16A,19A '-2026':15A,18A 'content':10A 'craft':5A 'cve':14A,17A 'fortianalyz':2A 'fortianalyzer':21A 'fortimanag':4A 'fortimanager':20A 'fortinet':1A 'inject':9A 'request':7A 'respons':13A 'saml':6A 'sign':12A","search_b":"'8.1':73B 'arbitrari':49B 'attack':46B,81B 'beyond':86B 'blind':64B 'chang':85B 'cloud':36B 'content':50B 'craft':39B 'cvss':70B 'describ':58B 'fortianalyz':22B,31B 'fortimanag':23B,33B 'fortinet':24B,30B 'host':28B 'includ':34B 'inject':48B,63B,66B 'issu':67B 'mishandl':38B 'read':83B 'remot':45B 'request':41B 'respons':55B 'saml':25B,40B,54B 'score':71B 'self':27B 'self-host':26B 'sign':53B 'sourc':57B 'state':78B 'unauthent':44B 'vendor':29B 'version':37B 'xml':62B 'xpath':65B","search_c":"'7.2.0':108C,140C '7.2.1':126C,158C '7.2.12':110C,128C,142C,160C '7.4.0':104C,136C '7.4.1':121C,153C '7.4.11':106C,123C,138C,155C '7.6.0':100C,116C,132C,148C '7.6.7':102C,118C,134C,150C '8.0.0':98C,113C,130C,145C 'aka':90C 'allow':162C 'arbitari':169C 'attack':166C 'blind':91C 'cloud':112C,115C,120C,125C,144C,147C,152C,157C 'content':170C 'craft':177C 'fortianalyz':97C,99C,103C,107C,111C,114C,119C,124C 'fortimanag':129C,131C,135C,139C,143C,146C,151C,156C 'fortinet':96C 'inject':89C,93C,168C 'may':161C 'remot':165C 'request':179C 'respons':175C 'saml':174C,178C 'sign':173C 'unauthent':164C 'via':176C 'vulner':94C 'xml':88C 'xpath':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126176","severity":null,"published_at":"2026-11-11T22:17:15+00:00","modified_at":"2026-11-11T22:17:15+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126176:3654","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222","severity":null,"published_at":"2026-11-11T22:45:28+00:00","modified_at":"2026-11-11T22:45:28+00:00","first_seen_at":"2026-11-11T22:45:28+00:00","fetched_at":"2026-11-11T22:45:28+00:00","note":"Fortinet FG-IR-26-222 (published 2026-11-10) covers CVE-2026-126176 and -126177; High, CVSS 8.1, unauthenticated, not known exploited, no workaround or virtual patch listed; impact field says denial of service. Fixed 8.0.1/7.6.8/7.4.12/7.2.13. SAML-required question unanswered by vendor. Product rows only carry 7.6 branch (one range per row); other branches are in the how-to-check. X/community not checked.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-222"]}],"documents":[{"id":129709,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222","title":"Fortinet FG-IR-26-222 XML injection (CVE-2026-126176, CVE-2026-126177)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}