FORTIMANAGER · CVE-2026-126177 · Vendor
FIX → 8.0.1 · 7.6.8 +2 ✓ verified
Fortinet FortiAnalyzer and FortiManager, including their Cloud versions, can be made to inject arbitrary content into a signed SAML response when they receive crafted SAML requests. The sources do not say what an attacker can do with the injected content beyond that.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-managed FortiManager or FortiAnalyzer, or their Cloud variants, on the affected versions. Fortinet describes an unauthenticated remote attacker injecting content into a signed SAML response via crafted SAML requests. The advisory does not say SAML SSO must be configured, so do not assume you can skip it. Fortinet lists no virtual patch and no workaround.
Not affected if unknown
Who cares fortianalyzer, fortimanager, fortinet, saml, self-hosted
8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12 (Cloud 7.4 and 7.2 start at 7.4.1 and )A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
7.2.1Upgrade to 8.0.1 · 7.6.8 +2
Upgrade to FortiManager/FortiAnalyzer (and Cloud) 8.0.1, 7.6.8, 7.4.12 or 7.2.13 or above, per branch.