{"id":"CVE-2026-126177","kind":"vulnerability","aliases":["CVE-2026-126177"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: unauthenticated SAML response content injection","description":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests.","summary":"Fortinet FortiAnalyzer and FortiManager, including their Cloud versions, can be made to inject arbitrary content into a signed SAML response when they receive crafted SAML requests. The sources do not say what an attacker can do with the injected content beyond that.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["7.2.13","7.4.12","7.6.8","8.0.1"],"affected":">= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; = 8.0.0","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["7.2.13","7.4.12","7.6.8","8.0.1"],"affected":">= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; = 8.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","saml","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"Read the firmware version on each FortiManager, FortiAnalyzer, and Cloud instance. Affected: 8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12 (Cloud 7.4 and 7.2 start at 7.4.1 and 7.2.1). Fortinet's advisory does not say whether SAML SSO must be enabled. Treat any device on these versions as exposed, and check whether SAML SSO is configured to rank urgency.","fix":"Upgrade to FortiManager/FortiAnalyzer (and Cloud) 8.0.1, 7.6.8, 7.4.12 or 7.2.13 or above, per branch.","status":"open","published_at":"2026-11-11T22:17:16+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:31:45+00:00","updated_at":"2026-11-11T22:45:18+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:31:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Fortinet FortiAnalyzer and FortiManager: unauthenticated SAML response content injection","impact":"medium","summary":"Fortinet FortiAnalyzer and FortiManager, including their Cloud versions, can be made to inject arbitrary content into a signed SAML response when they receive crafted SAML requests. The sources do not say what an attacker can do with the injected content beyond that.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","saml","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker injects arbitrary content into signed SAML responses","analyst_note":"Find the Fortinet PSIRT advisory for this CVE to confirm the fixed versions and whether SAML SSO must be enabled for exposure.","how_to_check":"- Check the installed version of FortiAnalyzer or FortiManager against the affected ranges listed in the description (for example `7.6.0` through `7.6.7`, `7.4.0` through `7.4.11`, `7.2.0` through `7.2.12`, and `8.0.0`).\n- Check whether SAML single sign-on is enabled on the device.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running affected FortiAnalyzer or FortiManager releases, including their Cloud versions, are in scope. The sources do not say whether SAML single sign-on must be enabled for exposure, and they do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000791,"input_tokens":4894,"output_tokens":603,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Fortinet PSIRT advisory for this CVE to confirm the fixed versions and whether SAML SSO must be enabled for exposure.","search":"'-126177':12A,15A '-2026':11A,14A '7.2.0':88C,120C '7.2.1':106C,138C '7.2.12':90C,108C,122C,140C '7.4.0':84C,116C '7.4.1':101C,133C '7.4.11':86C,103C,118C,135C '7.6.0':80C,96C,112C,128C '7.6.7':82C,98C,114C,130C '8.0.0':78C,93C,110C,125C 'aka':70C 'allow':142C 'arbitari':149C 'arbitrari':39B 'attack':59B,146C 'beyond':66B 'blind':71C 'cloud':32B,92C,95C,100C,105C,124C,127C,132C,137C 'content':8A,40B,65B,150C 'craft':49B,157C 'cve':10A,13A 'fortianalyz':2A,18B,27B,77C,79C,83C,87C,91C,94C,99C,104C 'fortianalyzer':17A 'fortimanag':4A,19B,29B,109C,111C,115C,119C,123C,126C,131C,136C 'fortimanager':16A 'fortinet':1A,20B,26B,76C 'host':24B 'includ':30B 'inject':9A,38B,64B,69C,73C,148C 'made':36B 'may':141C 'receiv':48B 'remot':145C 'request':51B,159C 'respons':7A,45B,155C 'saml':6A,21B,44B,50B,154C,158C 'say':56B 'self':23B 'self-host':22B 'sign':43B,153C 'sourc':53B 'unauthent':5A,144C 'vendor':25B 'version':33B 'via':156C 'vulner':74C 'xml':68C 'xpath':72C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed FortiManager or FortiAnalyzer, or their Cloud variants, on the affected versions. Fortinet describes an unauthenticated remote attacker injecting content into a signed SAML response via crafted SAML requests. The advisory does not say SAML SSO must be configured, so do not assume you can skip it. Fortinet lists no virtual patch and no workaround.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:45:18Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222","run_id":3653},"products":{"at":"2026-11-11T22:45:18Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222","run_id":3653}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortianalyzer","fortimanager"],"ptokens":["fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","saml","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126177':12A,15A '-2026':11A,14A 'content':8A 'cve':10A,13A 'fortianalyz':2A 'fortianalyzer':17A 'fortimanag':4A 'fortimanager':16A 'fortinet':1A 'inject':9A 'respons':7A 'saml':6A 'unauthent':5A","search_b":"'arbitrari':39B 'attack':59B 'beyond':66B 'cloud':32B 'content':40B,65B 'craft':49B 'fortianalyz':18B,27B 'fortimanag':19B,29B 'fortinet':20B,26B 'host':24B 'includ':30B 'inject':38B,64B 'made':36B 'receiv':48B 'request':51B 'respons':45B 'saml':21B,44B,50B 'say':56B 'self':23B 'self-host':22B 'sign':43B 'sourc':53B 'vendor':25B 'version':33B","search_c":"'7.2.0':88C,120C '7.2.1':106C,138C '7.2.12':90C,108C,122C,140C '7.4.0':84C,116C '7.4.1':101C,133C '7.4.11':86C,103C,118C,135C '7.6.0':80C,96C,112C,128C '7.6.7':82C,98C,114C,130C '8.0.0':78C,93C,110C,125C 'aka':70C 'allow':142C 'arbitari':149C 'attack':146C 'blind':71C 'cloud':92C,95C,100C,105C,124C,127C,132C,137C 'content':150C 'craft':157C 'fortianalyz':77C,79C,83C,87C,91C,94C,99C,104C 'fortimanag':109C,111C,115C,119C,123C,126C,131C,136C 'fortinet':76C 'inject':69C,73C,148C 'may':141C 'remot':145C 'request':159C 'respons':155C 'saml':154C,158C 'sign':153C 'unauthent':144C 'via':156C 'vulner':74C 'xml':68C 'xpath':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126177","severity":null,"published_at":"2026-11-11T22:17:16+00:00","modified_at":"2026-11-11T22:17:16+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126177:3653","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222","severity":null,"published_at":"2026-11-11T22:45:18+00:00","modified_at":"2026-11-11T22:45:18+00:00","first_seen_at":"2026-11-11T22:45:18+00:00","fetched_at":"2026-11-11T22:45:18+00:00","note":"Read Fortinet PSIRT FG-IR-26-222 (Nov 10 2026): fixed versions confirmed, found internally by Fortinet, not exploited, no virtual patch. The advisory lists impact as denial of service and does not say whether SAML SSO must be enabled. Posts not searched.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-222"]}],"documents":[{"id":129709,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222","title":"Fortinet FG-IR-26-222 XML injection (CVE-2026-126176, CVE-2026-126177)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}