{"id":"CVE-2026-126211","kind":"vulnerability","aliases":["CVE-2026-126211"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: authenticated users can escalate privileges","description":"A improper privilege management vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.1 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.1 through 7.6.8, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.1 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.1 through 7.6.8 may allow an authenticated privileged attacker to elevate their privileges via crafted JSON-RPC request.","summary":"FortiAnalyzer and FortiManager, Fortinet's log and central management appliances, contain an improper privilege management flaw in their JSON-RPC API. An authenticated attacker with privileged access can craft a request to elevate their own privileges.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["8.0.2","7.6.8"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.7","ecosystem":"vendor"},{"name":"FortiManager","fixed":["8.0.2","7.6.8"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.7","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["8.0.2"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.8","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["8.0.2"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","json-rpc","self-hosted","vendor"],"not_affected_if":["fixed-version","no-privileged-accounts-exposed","unaffected-versions","version-7.2","version-7.4"],"how_to_check":"Run 'get system status' on the FortiAnalyzer/FortiManager CLI (or check the GUI dashboard) for the version. Affected: 8.0.0-8.0.1, 7.6.1-7.6.7 (Cloud 7.6.1-7.6.8, Cloud 8.0.0-8.0.1). 7.4 and 7.2 are not affected. Exploitation needs an authenticated privileged account; review who holds admin/JSON-RPC API access.","fix":"Upgrade FortiAnalyzer and FortiManager 8.0.x to 8.0.2 or above; 7.6.x to 7.6.8 or above. Cloud 8.0 to 8.0.2 or above; Cloud 7.6 (7.6.1-7.6.8): migrate to a fixed release. 7.4 and 7.2 are not affected.","status":"open","published_at":"2026-11-11T22:17:18+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:33:39+00:00","updated_at":"2026-11-11T22:42:59+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:39Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources do not state a fixed version.","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: authenticated users can escalate privileges","impact":"medium","summary":"FortiAnalyzer and FortiManager, Fortinet's log and central management appliances, contain an improper privilege management flaw in their JSON-RPC API. An authenticated attacker with privileged access can craft a request to elevate their own privileges.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"privileged user gains higher administrative rights on the management appliance","analyst_note":"Confirm fixed versions and any vendor advisory from Fortinet PSIRT; the sources give only affected ranges.","how_to_check":"- Check the running version of FortiAnalyzer, FortiAnalyzer Cloud, FortiManager or FortiManager Cloud against the affected ranges listed in the sources.\n- unknown for any other check; the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-versions","no-privileged-accounts-exposed"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager (on-premises or Cloud) in the affected version ranges, 8.0.0 to 8.0.1 or 7.6.1 to 7.6.7 (and the Cloud variants 7.6.8). The attacker must already hold a privileged account on the management system. Teams that do not run these Fortinet products can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000783,"input_tokens":4718,"output_tokens":623,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm fixed versions and any vendor advisory from Fortinet PSIRT; the sources give only affected ranges.","search":"'-126211':12A,15A '-2026':11A,14A '7.6.1':81C,91C,99C,109C '7.6.7':83C,101C '7.6.8':93C,111C '8.0.0':77C,86C,95C,104C '8.0.1':79C,88C,97C,106C 'access':59B 'allow':113C 'api':53B 'applianc':41B 'attack':56B,117C 'authent':5A,55B,115C 'central':39B 'cloud':19A,21A,85C,90C,103C,108C 'contain':42B 'craft':61B,123C 'cve':10A,13A 'elev':65B,119C 'escal':8A 'flaw':47B 'fortianalyz':2A,22B,32B,76C,80C,84C,89C 'fortianalyzer':16A,18A 'fortimanag':4A,23B,34B,94C,98C,102C,107C 'fortimanager':17A,20A 'fortinet':1A,24B,35B,75C 'host':30B 'improp':44B,70C 'json':26B,51B,125C 'json-rpc':25B,50B,124C 'log':37B 'manag':40B,46B,72C 'may':112C 'privileg':9A,45B,58B,68B,71C,116C,121C 'request':63B,127C 'rpc':27B,52B,126C 'self':29B 'self-host':28B 'user':6A 'vendor':31B 'via':122C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiAnalyzer or FortiManager (including the Cloud variants) on 8.0.0-8.0.1 or 7.6.1-7.6.7 (Cloud 7.6.1-7.6.8) are exposed. An attacker must already have an authenticated privileged account and send a crafted JSON-RPC request to raise privileges. Teams on 7.4 or 7.2, or not using these products, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:42:59Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-231","run_id":3645},"products":{"at":"2026-11-11T22:42:59Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-231","run_id":3645},"how_to_check":{"at":"2026-11-11T22:42:59Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-231","run_id":3645},"who_affected":{"at":"2026-11-11T22:42:59Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-231","run_id":3645}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","jsonrpc","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126211':12A,15A '-2026':11A,14A 'authent':5A 'cloud':19A,21A 'cve':10A,13A 'escal':8A 'fortianalyz':2A 'fortianalyzer':16A,18A 'fortimanag':4A 'fortimanager':17A,20A 'fortinet':1A 'privileg':9A 'user':6A","search_b":"'access':59B 'api':53B 'applianc':41B 'attack':56B 'authent':55B 'central':39B 'contain':42B 'craft':61B 'elev':65B 'flaw':47B 'fortianalyz':22B,32B 'fortimanag':23B,34B 'fortinet':24B,35B 'host':30B 'improp':44B 'json':26B,51B 'json-rpc':25B,50B 'log':37B 'manag':40B,46B 'privileg':45B,58B,68B 'request':63B 'rpc':27B,52B 'self':29B 'self-host':28B 'vendor':31B","search_c":"'7.6.1':81C,91C,99C,109C '7.6.7':83C,101C '7.6.8':93C,111C '8.0.0':77C,86C,95C,104C '8.0.1':79C,88C,97C,106C 'allow':113C 'attack':117C 'authent':115C 'cloud':85C,90C,103C,108C 'craft':123C 'elev':119C 'fortianalyz':76C,80C,84C,89C 'fortimanag':94C,98C,102C,107C 'fortinet':75C 'improp':70C 'json':125C 'json-rpc':124C 'manag':72C 'may':112C 'privileg':71C,116C,121C 'request':127C 'rpc':126C 'via':122C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126211","severity":null,"published_at":"2026-11-11T22:17:18+00:00","modified_at":"2026-11-11T22:17:18+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126211:3645","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-231","severity":null,"published_at":"2026-11-11T22:42:59+00:00","modified_at":"2026-11-11T22:42:59+00:00","first_seen_at":"2026-11-11T22:42:59+00:00","fetched_at":"2026-11-11T22:42:59+00:00","note":"Read Fortinet PSIRT FG-IR-26-231 (CVE confirmed on page): affected/fixed versions, not exploited, no virtual patch. No workaround stated.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-231"]}],"documents":[{"id":129694,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-231","title":"Fortinet PSIRT FG-IR-26-231: Improper privilege management","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}