---
id: "CVE-2026-126185"
page: "https://infrastack.ai/live/CVE-2026-126185"
kind: "vulnerability"
aliases: ["CVE-2026-126185"]
title: "Fortinet FortiAnalyzer and FortiManager: admins can run unauthorized code"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-11-11T22:17:17+00:00"
first_seen_at: "2026-11-11T22:29:30+00:00"
updated_at: "2026-11-11T22:33:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126185", "first_seen_at": "2026-11-11T22:29:30+00:00"}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: admins can run unauthorized code

Link for people: https://infrastack.ai/live/CVE-2026-126185 (this .md is for agents)

FortiAnalyzer and FortiManager, Fortinet's security logging and management appliances, contain a code injection flaw. An authenticated administrator can send crafted requests to execute unauthorized code or commands on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of FortiAnalyzer or FortiManager (including Cloud editions) against the affected ranges listed in the NVD entry.

## Fix

- Upgrade to a fixed release from Fortinet's advisory; the fixed versions are not stated in the sources provided.

## Timeline

- 2026-11-11T22:29:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126185

## From the sources

A improper control of generation of code ('code injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_