---
id: "CVE-2026-126184"
page: "https://infrastack.ai/live/CVE-2026-126184"
kind: "vulnerability"
aliases: ["CVE-2026-126184"]
title: "Fortinet FortiAnalyzer and FortiManager: authentication bypass lets attackers disrupt HA state"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAnalyzer", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0 - 8.0.1; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0 - 8.0.1; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.1; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.1; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "high-availability", "unauthenticated", "vendor"]
not_affected_if: ["version-outside-listed-ranges"]
published_at: "2026-11-11T22:17:17+00:00"
first_seen_at: "2026-11-11T22:29:30+00:00"
updated_at: "2026-11-11T22:44:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126184", "first_seen_at": "2026-11-11T22:29:30+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-229", "first_seen_at": "2026-11-11T22:44:09+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-229"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: authentication bypass lets attackers disrupt HA state

Link for people: https://infrastack.ai/live/CVE-2026-126184 (this .md is for agents)

Fortinet FortiAnalyzer and FortiManager versions across several branches contain an authentication bypass by spoofing flaw. The sources say an attacker may be able to disrupt the high-availability (HA) state of these devices.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected 8.0.0 - 8.0.1; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiManager affected 8.0.0 - 8.0.1; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiAnalyzer Cloud affected 8.0.1; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiManager Cloud affected 8.0.1; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13

## How to check

Run 'get system status' on each FortiAnalyzer/FortiManager (or check Dashboard) and compare the version with: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12 (Cloud: 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12). Vendor lists no HA-only condition, but the impact is on HA state, so prioritise units in HA clusters. Also check FortiAnalyzer-BigData, which the advisory names but lists no versions for.

## Fix

Upgrade FortiAnalyzer/FortiManager (and Cloud) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or above, per branch.

## Timeline

- 2026-11-11T22:29:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126184
- 2026-11-11T22:44:09+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-229 — Read Fortinet PSIRT FG-IR-26-229: unauthenticated, network (CVSS AV:N/PR:N), fortilogd component, fixes per branch, not exploited, no virtual patch.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-229: Authentication bypass by spoofing https://fortiguard.fortinet.com/psirt/FG-IR-26-229

## From the sources

A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an attacker to disrupt the HA state.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_