---
id: "CVE-2026-126177"
page: "https://infrastack.ai/live/CVE-2026-126177"
kind: "vulnerability"
aliases: ["CVE-2026-126177"]
title: "Fortinet FortiAnalyzer and FortiManager: unauthenticated SAML response content injection"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiManager", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.1"], "affected": ">= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; = 8.0.0", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.1"], "affected": ">= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; = 8.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "saml", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-11-11T22:17:16+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:45:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126177", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-222", "first_seen_at": "2026-11-11T22:45:18+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-222"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: unauthenticated SAML response content injection

Link for people: https://infrastack.ai/live/CVE-2026-126177 (this .md is for agents)

Fortinet FortiAnalyzer and FortiManager, including their Cloud versions, can be made to inject arbitrary content into a signed SAML response when they receive crafted SAML requests. The sources do not say what an attacker can do with the injected content beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; = 8.0.0 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.1
- vendor:FortiAnalyzer affected >= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; = 8.0.0 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.1

## How to check

Read the firmware version on each FortiManager, FortiAnalyzer, and Cloud instance. Affected: 8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12 (Cloud 7.4 and 7.2 start at 7.4.1 and 7.2.1). Fortinet's advisory does not say whether SAML SSO must be enabled. Treat any device on these versions as exposed, and check whether SAML SSO is configured to rank urgency.

## Fix

Upgrade to FortiManager/FortiAnalyzer (and Cloud) 8.0.1, 7.6.8, 7.4.12 or 7.2.13 or above, per branch.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126177
- 2026-11-11T22:45:18+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-222 — Read Fortinet PSIRT FG-IR-26-222 (Nov 10 2026): fixed versions confirmed, found internally by Fortinet, not exploited, no virtual patch. The advisory lists impact as denial of service and does not say whether SAML SSO must be enabled. Posts not searched.

## Documents

- [advisory] Fortinet FG-IR-26-222 XML injection (CVE-2026-126176, CVE-2026-126177) https://fortiguard.fortinet.com/psirt/FG-IR-26-222

## From the sources

A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_