---
id: "CVE-2026-126179"
page: "https://infrastack.ai/live/CVE-2026-126179"
kind: "vulnerability"
aliases: ["CVE-2026-126179"]
title: "Fortinet FortiAnalyzer and FortiManager: admin OS command injection"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiAnalyzer", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.1"], "affected": ">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.1"], "affected": ">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.1"], "affected": ">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.1"], "affected": ">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["fixed-version", "no-admin-access-exposed", "versions-outside-ranges"]
published_at: "2026-11-11T22:17:16+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:45:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126179", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-224", "first_seen_at": "2026-11-11T22:45:15+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-224"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: admin OS command injection

Link for people: https://infrastack.ai/live/CVE-2026-126179 (this .md is for agents)

Fortinet FortiAnalyzer and FortiManager, including their Cloud versions, contain an OS command injection flaw in how they handle specially crafted requests. An authenticated administrator can run unauthorized commands on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected >= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.1
- vendor:FortiManager affected >= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.1
- vendor:FortiAnalyzer Cloud affected >= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.1
- vendor:FortiManager Cloud affected >= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; = 8.0.0 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.1

## How to check

Check the installed version (System Settings > Dashboard, or CLI: get system status). Affected: 8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12 for FortiAnalyzer and FortiManager. The Cloud variants are affected at 8.0.0, 7.6.0-7.6.7, 7.4.1-7.4.11 and 7.2.1-7.2.12. Fortinet states no virtual patch. Also review who holds admin accounts and limit management interface access to trusted hosts.

## Fix

Upgrade FortiAnalyzer / FortiManager (and Cloud) to 8.0.1, 7.6.8, 7.4.12 or 7.2.13 or above, per branch. Fortinet lists no workaround and no virtual patch.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126179
- 2026-11-11T22:45:15+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-224 — Read Fortinet PSIRT FG-IR-26-224: fixed versions 8.0.1/7.6.8/7.4.12/7.2.13, not exploited, no virtual patch, no workaround listed. Internally found by Fortinet. No X/social check done (not needed for B).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-224 https://fortiguard.fortinet.com/psirt/FG-IR-26-224

## From the sources

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_