---
id: "CVE-2026-126176"
page: "https://infrastack.ai/live/CVE-2026-126176"
kind: "vulnerability"
aliases: ["CVE-2026-126176"]
title: "Fortinet FortiAnalyzer and FortiManager: crafted SAML requests can inject content into signed responses"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiManager", "fixed": ["7.6.8"], "affected": ">= 7.6.0, < 7.6.8", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["7.6.8"], "affected": ">= 7.6.0, < 7.6.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "saml", "self-hosted", "vendor"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-11T22:17:15+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:45:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126176", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-222", "first_seen_at": "2026-11-11T22:45:28+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-222"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: crafted SAML requests can inject content into signed responses

Link for people: https://infrastack.ai/live/CVE-2026-126176 (this .md is for agents)

Fortinet FortiAnalyzer and FortiManager, including their cloud versions, mishandle crafted SAML requests so an unauthenticated remote attacker can inject arbitrary content into a signed SAML response. The sources describe this as an XML injection (blind XPath injection) issue with a CVSS score of 8.1, but they do not state what the attacker can read or change beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 7.6.0, < 7.6.8 fixed 7.6.8
- vendor:FortiAnalyzer affected >= 7.6.0, < 7.6.8 fixed 7.6.8

## How to check

Run 'get system status' on the FortiAnalyzer/FortiManager CLI (or check the dashboard) and compare the version with the affected ranges: 8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12. Cloud variants: 8.0.0; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12. Fortinet's advisory does not say whether SAML SSO must be configured for exposure, so treat any device in these ranges as exposed until patched. It lists no workaround and no virtual patch.

## Fix

Upgrade FortiAnalyzer/FortiManager (and Cloud) to 8.0.1, 7.6.8, 7.4.12 or 7.2.13 or later, per branch.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126176
- 2026-11-11T22:45:28+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-222 — Fortinet FG-IR-26-222 (published 2026-11-10) covers CVE-2026-126176 and -126177; High, CVSS 8.1, unauthenticated, not known exploited, no workaround or virtual patch listed; impact field says denial of service. Fixed 8.0.1/7.6.8/7.4.12/7.2.13. SAML-required question unanswered by vendor. Product rows only carry 7.6 branch (one range per row); other branches are in the how-to-check. X/community not checked.

## Documents

- [advisory] Fortinet FG-IR-26-222 XML injection (CVE-2026-126176, CVE-2026-126177) https://fortiguard.fortinet.com/psirt/FG-IR-26-222

## From the sources

A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_