---
id: "CVE-2026-126178"
page: "https://infrastack.ai/live/CVE-2026-126178"
kind: "vulnerability"
aliases: ["CVE-2026-126178"]
title: "Fortinet FortiAnalyzer and FortiManager: heap overflow lets an admin run code"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiManager", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; >= 8.0.0, < 8.0.2", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; >= 8.0.0, < 8.0.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["no-admin-access-exposed", "patched-version", "versions-outside-listed-ranges"]
published_at: "2026-11-11T22:17:16+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:45:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126178", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-223", "first_seen_at": "2026-11-11T22:45:17+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-223"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: heap overflow lets an admin run code

Link for people: https://infrastack.ai/live/CVE-2026-126178 (this .md is for agents)

A heap-based buffer overflow in Fortinet FortiAnalyzer and FortiManager, including their Cloud editions, can be triggered by a crafted request. An attacker with admin privileges could execute unauthorized code or commands on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; >= 8.0.0, < 8.0.2 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2
- vendor:FortiAnalyzer affected >= 7.2.0, < 7.2.13; >= 7.4.0, < 7.4.12; >= 7.6.0, < 7.6.8; >= 8.0.0, < 8.0.2 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2

## How to check

Check version in the admin GUI dashboard or run 'get system status' on the CLI. Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12 (Cloud 7.4/7.2 from 7.4.1/7.2.1). Fixed in 8.0.2, 7.6.8, 7.4.12, 7.2.13.

## Fix

Upgrade FortiManager/FortiAnalyzer (and Cloud) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or later, per branch.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126178
- 2026-11-11T22:45:17+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-223 — Restated product rows with all branches.

## Documents

- [advisory] FortiGuard PSIRT FG-IR-26-223 Heap-based buffer overflow https://www.fortiguard.com/psirt/FG-IR-26-223

## From the sources

A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via a crafted request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_