{"id":"CVE-2026-126178","kind":"vulnerability","aliases":["CVE-2026-126178"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: heap overflow lets an admin run code","description":"A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via a crafted request.","summary":"A heap-based buffer overflow in Fortinet FortiAnalyzer and FortiManager, including their Cloud editions, can be triggered by a crafted request. An attacker with admin privileges could execute unauthorized code or commands on the device.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; >= 8.0.0, < 8.0.2","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; >= 8.0.0, < 8.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["no-admin-access-exposed","patched-version","versions-outside-listed-ranges"],"how_to_check":"Check version in the admin GUI dashboard or run 'get system status' on the CLI. Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12 (Cloud 7.4/7.2 from 7.4.1/7.2.1). Fixed in 8.0.2, 7.6.8, 7.4.12, 7.2.13.","fix":"Upgrade FortiManager/FortiAnalyzer (and Cloud) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or later, per branch.","status":"open","published_at":"2026-11-11T22:17:16+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:33:44+00:00","updated_at":"2026-11-11T22:45:22+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T22:33:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: heap overflow lets an admin run code","impact":"high","summary":"A heap-based buffer overflow in Fortinet FortiAnalyzer and FortiManager, including their Cloud editions, can be triggered by a crafted request. An attacker with admin privileges could execute unauthorized code or commands on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Admin attacker runs unauthorized code or commands on the device.","analyst_note":"Confirm the fixed versions and any vendor advisory (FortiGuard PSIRT) for this CVE; the sources list only affected ranges.","how_to_check":"- Check the installed FortiAnalyzer or FortiManager version in the admin console and compare it with the affected ranges listed in the description (8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12).\n- unknown for any other check; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-listed-ranges","no-admin-access-exposed"],"who_is_affected":"Organisations running FortiAnalyzer or FortiManager, on-premises or as Cloud, in the listed version ranges. Exploitation needs an account with admin privileges, so exposure is limited to who can already log in as an administrator. The sources do not say which configurations are affected beyond the version ranges.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000821,"input_tokens":4919,"output_tokens":658,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and any vendor advisory (FortiGuard PSIRT) for this CVE; the sources list only affected ranges.","search":"'-126178':14A,17A '-2026':13A,16A '7.2.0':85C,121C '7.2.1':105C,141C '7.2.12':87C,107C,123C,143C '7.4.0':81C,117C '7.4.1':100C,136C '7.4.11':83C,102C,119C,138C '7.6.0':77C,95C,113C,131C '7.6.7':79C,97C,115C,133C '8.0.0':73C,90C,109C,126C '8.0.1':75C,92C,111C,128C 'admin':9A,52B,150C 'allow':145C 'attack':50B,148C 'authent':147C 'base':30B,66C 'buffer':31B,67C 'cloud':40B,89C,94C,99C,104C,125C,130C,135C,140C 'code':11A,57B,155C 'command':59B,157C 'could':54B 'craft':47B,160C 'cve':12A,15A 'devic':62B 'edit':41B 'execut':55B,153C 'fortianalyz':2A,20B,35B,72C,76C,80C,84C,88C,93C,98C,103C 'fortianalyzer':19A 'fortimanag':4A,21B,37B,108C,112C,116C,120C,124C,129C,134C,139C 'fortimanager':18A 'fortinet':1A,22B,34B,71C 'heap':5A,29B,65C 'heap-bas':28B,64C 'host':26B 'includ':38B 'infrastructur':23B 'let':7A 'may':144C 'overflow':6A,32B,68C 'privileg':53B,151C 'request':48B,161C 'run':10A 'self':25B 'self-host':24B 'trigger':44B 'unauthor':56B,154C 'via':158C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Self-managed FortiManager and FortiAnalyzer appliances or VMs, plus their Cloud editions, on the versions listed by Fortinet. Exploitation needs an authenticated attacker with admin privileges sending a crafted request to the API, so risk is highest where admin credentials are shared, weak, or the management interface is reachable from untrusted networks. Fortinet reports no known exploitation (CVSS 7.2), and no virtual patch.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:45:17Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-223","run_id":3652},"products":{"at":"2026-11-11T22:45:22Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-223","run_id":3652},"how_to_check":{"at":"2026-11-11T22:45:17Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-223","run_id":3652},"who_affected":{"at":"2026-11-11T22:45:17Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-223","run_id":3652}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortianalyzer","fortimanager"],"ptokens":["fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126178':14A,17A '-2026':13A,16A 'admin':9A 'code':11A 'cve':12A,15A 'fortianalyz':2A 'fortianalyzer':19A 'fortimanag':4A 'fortimanager':18A 'fortinet':1A 'heap':5A 'let':7A 'overflow':6A 'run':10A","search_b":"'admin':52B 'attack':50B 'base':30B 'buffer':31B 'cloud':40B 'code':57B 'command':59B 'could':54B 'craft':47B 'devic':62B 'edit':41B 'execut':55B 'fortianalyz':20B,35B 'fortimanag':21B,37B 'fortinet':22B,34B 'heap':29B 'heap-bas':28B 'host':26B 'includ':38B 'infrastructur':23B 'overflow':32B 'privileg':53B 'request':48B 'self':25B 'self-host':24B 'trigger':44B 'unauthor':56B","search_c":"'7.2.0':85C,121C '7.2.1':105C,141C '7.2.12':87C,107C,123C,143C '7.4.0':81C,117C '7.4.1':100C,136C '7.4.11':83C,102C,119C,138C '7.6.0':77C,95C,113C,131C '7.6.7':79C,97C,115C,133C '8.0.0':73C,90C,109C,126C '8.0.1':75C,92C,111C,128C 'admin':150C 'allow':145C 'attack':148C 'authent':147C 'base':66C 'buffer':67C 'cloud':89C,94C,99C,104C,125C,130C,135C,140C 'code':155C 'command':157C 'craft':160C 'execut':153C 'fortianalyz':72C,76C,80C,84C,88C,93C,98C,103C 'fortimanag':108C,112C,116C,120C,124C,129C,134C,139C 'fortinet':71C 'heap':65C 'heap-bas':64C 'may':144C 'overflow':68C 'privileg':151C 'request':161C 'unauthor':154C 'via':158C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126178","severity":null,"published_at":"2026-11-11T22:17:16+00:00","modified_at":"2026-11-11T22:17:16+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126178:3652","url":"https://www.fortiguard.com/psirt/FG-IR-26-223","severity":null,"published_at":"2026-11-11T22:45:17+00:00","modified_at":"2026-11-11T22:45:22+00:00","first_seen_at":"2026-11-11T22:45:17+00:00","fetched_at":"2026-11-11T22:45:22+00:00","note":"Restated product rows with all branches.","cites":["https://www.fortiguard.com/psirt/FG-IR-26-223"]}],"documents":[{"id":129710,"url":"https://www.fortiguard.com/psirt/FG-IR-26-223","title":"FortiGuard PSIRT FG-IR-26-223 Heap-based buffer overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}