{"id":"CVE-2026-126184","kind":"vulnerability","aliases":["CVE-2026-126184"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: authentication bypass lets attackers disrupt HA state","description":"A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an attacker to disrupt the HA state.","summary":"Fortinet FortiAnalyzer and FortiManager versions across several branches contain an authentication bypass by spoofing flaw. The sources say an attacker may be able to disrupt the high-availability (HA) state of these devices.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0 - 8.0.1; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12","ecosystem":"vendor"},{"name":"FortiManager","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0 - 8.0.1; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.1; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.1; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","high-availability","unauthenticated","vendor"],"not_affected_if":["version-outside-listed-ranges"],"how_to_check":"Run 'get system status' on each FortiAnalyzer/FortiManager (or check Dashboard) and compare the version with: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12 (Cloud: 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12). Vendor lists no HA-only condition, but the impact is on HA state, so prioritise units in HA clusters. Also check FortiAnalyzer-BigData, which the advisory names but lists no versions for.","fix":"Upgrade FortiAnalyzer/FortiManager (and Cloud) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or above, per branch.","status":"open","published_at":"2026-11-11T22:17:17+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:31:40+00:00","updated_at":"2026-11-11T22:44:09+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:31:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Fortinet FortiAnalyzer and FortiManager: authentication bypass lets attackers disrupt HA state","impact":"medium","summary":"Fortinet FortiAnalyzer and FortiManager versions across several branches contain an authentication bypass by spoofing flaw. The sources say an attacker may be able to disrupt the high-availability (HA) state of these devices.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","high-availability"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker disrupts HA state of management appliances","analyst_note":"Check the Fortinet PSIRT advisory for CVE-2026-126184 for the fixed versions, whether the flaw is reachable from the network, and whether authentication is needed.","how_to_check":"- Check the installed FortiAnalyzer and FortiManager version against the affected ranges listed in the description (for example `7.6.0` through `7.6.7`, `7.4.0` through `7.4.11`, `7.2.0` through `7.2.12`, `8.0.0` through `8.0.1`)\n- Check whether the devices run in an HA cluster\n- unknown for other checks: the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager, on-premises or as Cloud versions, in the listed version ranges. Systems outside those ranges, or devices not running HA, are not described as affected by the sources. The sources do not say what configuration is needed beyond the version ranges.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00082,"input_tokens":4886,"output_tokens":662,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for CVE-2026-126184 for the fixed versions, whether the flaw is reachable from the network, and whether authentication is needed.","search":"'-126184':14A,17A '-2026':13A,16A '7.2.0':87C,121C '7.2.1':105C,139C '7.2.12':89C,107C,123C,141C '7.4.0':83C,117C '7.4.1':100C,134C '7.4.11':85C,102C,119C,136C '7.6.0':79C,95C,113C,129C '7.6.7':81C,97C,115C,131C '8.0.0':75C,109C '8.0.1':77C,92C,111C,126C 'abl':54B 'across':37B 'allow':143C 'attack':8A,51B,145C 'authent':5A,42B,67C 'avail':29B,60B 'branch':39B 'bypass':6A,43B,68C 'cloud':21A,23A,91C,94C,99C,104C,125C,128C,133C,138C 'contain':40B 'cve':12A,15A 'devic':65B 'disrupt':9A,56B,147C 'flaw':46B 'fortianalyz':2A,24B,33B,74C,78C,82C,86C,90C,93C,98C,103C 'fortianalyzer':18A,20A 'fortimanag':4A,25B,35B,108C,112C,116C,120C,124C,127C,132C,137C 'fortimanager':19A,22A 'fortinet':1A,26B,32B,73C 'ha':10A,61B,149C 'high':28B,59B 'high-avail':27B,58B 'let':7A 'may':52B,142C 'say':49B 'sever':38B 'sourc':48B 'spoof':45B,70C 'state':11A,62B,150C 'unauthent':30B 'vendor':31B 'version':36B 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiAnalyzer or FortiManager, on-premises or Cloud, in the listed version ranges. Fortinet rates the attack type unauthenticated and the flaw is in the fortilogd component; the impact is that an attacker may disrupt the HA state. Units on fixed versions can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:44:09Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-229","run_id":3646},"products":{"at":"2026-11-11T22:44:09Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-229","run_id":3646},"how_to_check":{"at":"2026-11-11T22:44:09Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-229","run_id":3646},"who_affected":{"at":"2026-11-11T22:44:09Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-229","run_id":3646}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","highavailability","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-126184':14A,17A '-2026':13A,16A 'attack':8A 'authent':5A 'bypass':6A 'cloud':21A,23A 'cve':12A,15A 'disrupt':9A 'fortianalyz':2A 'fortianalyzer':18A,20A 'fortimanag':4A 'fortimanager':19A,22A 'fortinet':1A 'ha':10A 'let':7A 'state':11A","search_b":"'abl':54B 'across':37B 'attack':51B 'authent':42B 'avail':29B,60B 'branch':39B 'bypass':43B 'contain':40B 'devic':65B 'disrupt':56B 'flaw':46B 'fortianalyz':24B,33B 'fortimanag':25B,35B 'fortinet':26B,32B 'ha':61B 'high':28B,59B 'high-avail':27B,58B 'may':52B 'say':49B 'sever':38B 'sourc':48B 'spoof':45B 'state':62B 'unauthent':30B 'vendor':31B 'version':36B","search_c":"'7.2.0':87C,121C '7.2.1':105C,139C '7.2.12':89C,107C,123C,141C '7.4.0':83C,117C '7.4.1':100C,134C '7.4.11':85C,102C,119C,136C '7.6.0':79C,95C,113C,129C '7.6.7':81C,97C,115C,131C '8.0.0':75C,109C '8.0.1':77C,92C,111C,126C 'allow':143C 'attack':145C 'authent':67C 'bypass':68C 'cloud':91C,94C,99C,104C,125C,128C,133C,138C 'disrupt':147C 'fortianalyz':74C,78C,82C,86C,90C,93C,98C,103C 'fortimanag':108C,112C,116C,120C,124C,127C,132C,137C 'fortinet':73C 'ha':149C 'may':142C 'spoof':70C 'state':150C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126184","severity":null,"published_at":"2026-11-11T22:17:17+00:00","modified_at":"2026-11-11T22:17:17+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126184:3646","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-229","severity":null,"published_at":"2026-11-11T22:44:09+00:00","modified_at":"2026-11-11T22:44:09+00:00","first_seen_at":"2026-11-11T22:44:09+00:00","fetched_at":"2026-11-11T22:44:09+00:00","note":"Read Fortinet PSIRT FG-IR-26-229: unauthenticated, network (CVSS AV:N/PR:N), fortilogd component, fixes per branch, not exploited, no virtual patch.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-229"]}],"documents":[{"id":129707,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-229","title":"Fortinet PSIRT FG-IR-26-229: Authentication bypass by spoofing","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}