{"id":"CVE-2026-126179","kind":"vulnerability","aliases":["CVE-2026-126179"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: admin OS command injection","description":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests","summary":"Fortinet FortiAnalyzer and FortiManager, including their Cloud versions, contain an OS command injection flaw in how they handle specially crafted requests. An authenticated administrator can run unauthorized commands on the appliance.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["7.2.13","7.4.12","7.6.8","8.0.1"],"affected":">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0","ecosystem":"vendor"},{"name":"FortiManager","fixed":["7.2.13","7.4.12","7.6.8","8.0.1"],"affected":">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["7.2.13","7.4.12","7.6.8","8.0.1"],"affected":">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["7.2.13","7.4.12","7.6.8","8.0.1"],"affected":">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["fixed-version","no-admin-access-exposed","versions-outside-ranges"],"how_to_check":"Check the installed version (System Settings > Dashboard, or CLI: get system status). Affected: 8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12 for FortiAnalyzer and FortiManager. The Cloud variants are affected at 8.0.0, 7.6.0-7.6.7, 7.4.1-7.4.11 and 7.2.1-7.2.12. Fortinet states no virtual patch. Also review who holds admin accounts and limit management interface access to trusted hosts.","fix":"Upgrade FortiAnalyzer / FortiManager (and Cloud) to 8.0.1, 7.6.8, 7.4.12 or 7.2.13 or above, per branch. Fortinet lists no workaround and no virtual patch.","status":"open","published_at":"2026-11-11T22:17:16+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:33:42+00:00","updated_at":"2026-11-11T22:45:15+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T22:33:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: admin OS command injection","impact":"high","summary":"Fortinet FortiAnalyzer and FortiManager, including their Cloud versions, contain an OS command injection flaw in how they handle specially crafted requests. An authenticated administrator can run unauthorized commands on the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated admin runs unauthorized OS commands on the appliance","analyst_note":"Check the Fortinet PSIRT advisory for CVE-2026-126179 for the fixed versions and any workaround; the sources here give only the affected ranges.","how_to_check":"- Check the installed FortiAnalyzer or FortiManager version against the affected ranges: FortiAnalyzer 7.2.0 through 7.2.12, 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0; FortiManager with the same ranges.\n- Confirm whether the FortiAnalyzer Cloud or FortiManager Cloud service is in use, since the same ranges apply.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-ranges","no-admin-access-exposed"],"who_is_affected":"Any organisation running the listed FortiAnalyzer or FortiManager versions, including the Cloud variants, is affected. The attacker needs administrator credentials, so exposure depends on who holds admin accounts and how management interfaces are reachable. The sources do not say whether a default configuration is affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000818,"input_tokens":4862,"output_tokens":664,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for CVE-2026-126179 for the fixed versions and any workaround; the sources here give only the affected ranges.","search":"'-126179':11A,14A '-2026':10A,13A '7.2.0':87C,119C '7.2.1':105C,137C '7.2.12':89C,107C,121C,139C '7.4.0':83C,115C '7.4.1':100C,132C '7.4.11':85C,102C,117C,134C '7.6.0':79C,95C,111C,127C '7.6.7':81C,97C,113C,129C '8.0.0':77C,92C,109C,124C 'admin':5A 'administr':51B,144C 'allow':141C 'applianc':58B 'authent':50B,143C 'cloud':18A,20A,34B,91C,94C,99C,104C,123C,126C,131C,136C 'code':148C 'command':7A,39B,55B,69C,71C,150C 'contain':36B 'craft':47B,153C 'cve':9A,12A 'element':64C 'execut':146C 'flaw':41B 'fortianalyz':2A,21B,29B,76C,78C,82C,86C,90C,93C,98C,103C 'fortianalyzer':15A,17A 'fortimanag':4A,22B,31B,108C,110C,114C,118C,122C,125C,130C,135C 'fortimanager':16A,19A 'fortinet':1A,23B,28B,75C 'handl':45B 'host':27B 'improp':60C 'includ':32B 'infrastructur':24B 'inject':8A,40B,72C 'may':140C 'neutral':61C 'os':6A,38B,68C,70C 'request':48B,154C 'run':53B 'self':26B 'self-host':25B 'special':46B,63C,152C 'unauthor':54B,147C 'use':65C 'version':35B 'via':151C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Any team running FortiAnalyzer or FortiManager (or their Cloud variants) in the versions listed by Fortinet. The attacker must be an authenticated administrator, so exposure depends on who holds admin accounts and how reachable the management interface/API is. Fortinet says it is not known to be exploited. Teams that do not use these products, or already run a fixed version, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:45:15Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-224","run_id":3651},"products":{"at":"2026-11-11T22:45:15Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-224","run_id":3651},"how_to_check":{"at":"2026-11-11T22:45:15Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-224","run_id":3651},"who_affected":{"at":"2026-11-11T22:45:15Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-224","run_id":3651}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126179':11A,14A '-2026':10A,13A 'admin':5A 'cloud':18A,20A 'command':7A 'cve':9A,12A 'fortianalyz':2A 'fortianalyzer':15A,17A 'fortimanag':4A 'fortimanager':16A,19A 'fortinet':1A 'inject':8A 'os':6A","search_b":"'administr':51B 'applianc':58B 'authent':50B 'cloud':34B 'command':39B,55B 'contain':36B 'craft':47B 'flaw':41B 'fortianalyz':21B,29B 'fortimanag':22B,31B 'fortinet':23B,28B 'handl':45B 'host':27B 'includ':32B 'infrastructur':24B 'inject':40B 'os':38B 'request':48B 'run':53B 'self':26B 'self-host':25B 'special':46B 'unauthor':54B 'version':35B","search_c":"'7.2.0':87C,119C '7.2.1':105C,137C '7.2.12':89C,107C,121C,139C '7.4.0':83C,115C '7.4.1':100C,132C '7.4.11':85C,102C,117C,134C '7.6.0':79C,95C,111C,127C '7.6.7':81C,97C,113C,129C '8.0.0':77C,92C,109C,124C 'administr':144C 'allow':141C 'authent':143C 'cloud':91C,94C,99C,104C,123C,126C,131C,136C 'code':148C 'command':69C,71C,150C 'craft':153C 'element':64C 'execut':146C 'fortianalyz':76C,78C,82C,86C,90C,93C,98C,103C 'fortimanag':108C,110C,114C,118C,122C,125C,130C,135C 'fortinet':75C 'improp':60C 'inject':72C 'may':140C 'neutral':61C 'os':68C,70C 'request':154C 'special':63C,152C 'unauthor':147C 'use':65C 'via':151C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126179","severity":null,"published_at":"2026-11-11T22:17:16+00:00","modified_at":"2026-11-11T22:17:16+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126179:3651","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-224","severity":null,"published_at":"2026-11-11T22:45:15+00:00","modified_at":"2026-11-11T22:45:15+00:00","first_seen_at":"2026-11-11T22:45:15+00:00","fetched_at":"2026-11-11T22:45:15+00:00","note":"Read Fortinet PSIRT FG-IR-26-224: fixed versions 8.0.1/7.6.8/7.4.12/7.2.13, not exploited, no virtual patch, no workaround listed. Internally found by Fortinet. No X/social check done (not needed for B).","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-224"]}],"documents":[{"id":129708,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-224","title":"Fortinet PSIRT FG-IR-26-224","kind":"advisory","source":"analyst","publisher":null,"text":"FortiAnalyzer/FortiManager (and Cloud) OS command injection CWE-78 in API, authenticated admin. Fixed: 8.0.1, 7.6.8, 7.4.12, 7.2.13. Known exploited: No. Virtual patch: No.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}