{"id":"CVE-2026-126185","kind":"vulnerability","aliases":["CVE-2026-126185"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: admins can run unauthorized code","description":"A improper control of generation of code ('code injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests.","summary":"FortiAnalyzer and FortiManager, Fortinet's security logging and management appliances, contain a code injection flaw. An authenticated administrator can send crafted requests to execute unauthorized code or commands on the device.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"- Check the installed version of FortiAnalyzer or FortiManager (including Cloud editions) against the affected ranges listed in the NVD entry.","fix":"- Upgrade to a fixed release from Fortinet's advisory; the fixed versions are not stated in the sources provided.","status":"open","published_at":"2026-11-11T22:17:17+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:33:39+00:00","updated_at":"2026-11-11T22:33:39+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T22:33:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a fixed release from Fortinet's advisory; the fixed versions are not stated in the sources provided.","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: admins can run unauthorized code","impact":"high","summary":"FortiAnalyzer and FortiManager, Fortinet's security logging and management appliances, contain a code injection flaw. An authenticated administrator can send crafted requests to execute unauthorized code or commands on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"administrator code runs on the appliance, with command execution","analyst_note":"Confirm fixed versions and any workaround from Fortinet's PSIRT advisory; the NVD entry alone does not state them.","how_to_check":"- Check the installed version of FortiAnalyzer or FortiManager (including Cloud editions) against the affected ranges listed in the NVD entry.\n- unknown for other checks: the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager, on-premises or in the Cloud edition, in the listed 8.0.0 to 8.0.1, 7.6.0 to 7.6.7, and 7.4.0 to 7.4.11 ranges. Exploitation requires an authenticated administrator account, so exposure depends on who holds admin access. unknown whether any other configuration matters.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000789,"input_tokens":4805,"output_tokens":617,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126185':12A,15A '-2026':11A,14A '7.4.0':75C,102C '7.4.1':90C,117C '7.4.11':77C,92C,104C,119C '7.6.0':71C,85C,98C,112C '7.6.7':73C,87C,100C,114C '8.0.0':67C,80C,94C,107C '8.0.1':69C,82C,96C,109C 'admin':5A 'administr':40B,124C 'allow':121C 'applianc':32B 'authent':39B,123C 'cloud':79C,84C,89C,106C,111C,116C 'code':9A,35B,48B,60C,61C,128C 'command':50B,130C 'contain':33B 'control':56C 'craft':43B,133C 'cve':10A,13A 'devic':53B 'execut':46B,126C 'flaw':37B 'fortianalyz':2A,16B,23B,66C,70C,74C,78C,83C,88C 'fortimanag':4A,17B,25B,93C,97C,101C,105C,110C,115C 'fortinet':1A,18B,26B,65C 'generat':58C 'host':22B 'improp':55C 'infrastructur':19B 'inject':36B,62C 'log':29B 'manag':31B 'may':120C 'request':44B,134C 'run':7A 'secur':28B 'self':21B 'self-host':20B 'send':42B 'special':132C 'unauthor':8A,47B,127C 'via':131C 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiAnalyzer or FortiManager, on-premises or in the Cloud edition, in the listed 8.0.0 to 8.0.1, 7.6.0 to 7.6.7, and 7.4.0 to 7.4.11 ranges. Exploitation requires an authenticated administrator account, so exposure depends on who holds admin access. unknown whether any other configuration matters.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fortianalyzer","fortimanager","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126185':12A,15A '-2026':11A,14A 'admin':5A 'code':9A 'cve':10A,13A 'fortianalyz':2A 'fortimanag':4A 'fortinet':1A 'run':7A 'unauthor':8A","search_b":"'administr':40B 'applianc':32B 'authent':39B 'code':35B,48B 'command':50B 'contain':33B 'craft':43B 'devic':53B 'execut':46B 'flaw':37B 'fortianalyz':16B,23B 'fortimanag':17B,25B 'fortinet':18B,26B 'host':22B 'infrastructur':19B 'inject':36B 'log':29B 'manag':31B 'request':44B 'secur':28B 'self':21B 'self-host':20B 'send':42B 'unauthor':47B","search_c":"'7.4.0':75C,102C '7.4.1':90C,117C '7.4.11':77C,92C,104C,119C '7.6.0':71C,85C,98C,112C '7.6.7':73C,87C,100C,114C '8.0.0':67C,80C,94C,107C '8.0.1':69C,82C,96C,109C 'administr':124C 'allow':121C 'authent':123C 'cloud':79C,84C,89C,106C,111C,116C 'code':60C,61C,128C 'command':130C 'control':56C 'craft':133C 'execut':126C 'fortianalyz':66C,70C,74C,78C,83C,88C 'fortimanag':93C,97C,101C,105C,110C,115C 'fortinet':65C 'generat':58C 'improp':55C 'inject':62C 'may':120C 'request':134C 'special':132C 'unauthor':127C 'via':131C 'vulner':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126185","severity":null,"published_at":"2026-11-11T22:17:17+00:00","modified_at":"2026-11-11T22:17:17+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}