---
id: "CVE-2026-126211"
page: "https://infrastack.ai/live/CVE-2026-126211"
kind: "vulnerability"
aliases: ["CVE-2026-126211"]
title: "Fortinet FortiAnalyzer and FortiManager: authenticated users can escalate privileges"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAnalyzer", "fixed": ["8.0.2", "7.6.8"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.7", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["8.0.2", "7.6.8"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.7", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["8.0.2"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.8", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["8.0.2"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "json-rpc", "self-hosted", "vendor"]
not_affected_if: ["fixed-version", "no-privileged-accounts-exposed", "unaffected-versions", "version-7.2", "version-7.4"]
published_at: "2026-11-11T22:17:18+00:00"
first_seen_at: "2026-11-11T22:29:30+00:00"
updated_at: "2026-11-11T22:42:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126211", "first_seen_at": "2026-11-11T22:29:30+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-231", "first_seen_at": "2026-11-11T22:42:59+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-231"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: authenticated users can escalate privileges

Link for people: https://infrastack.ai/live/CVE-2026-126211 (this .md is for agents)

FortiAnalyzer and FortiManager, Fortinet's log and central management appliances, contain an improper privilege management flaw in their JSON-RPC API. An authenticated attacker with privileged access can craft a request to elevate their own privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected >= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.7 fixed 8.0.2, 7.6.8
- vendor:FortiManager affected >= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.7 fixed 8.0.2, 7.6.8
- vendor:FortiAnalyzer Cloud affected >= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.8 fixed 8.0.2
- vendor:FortiManager Cloud affected >= 8.0.0, <= 8.0.1; >= 7.6.1, <= 7.6.8 fixed 8.0.2

## How to check

Run 'get system status' on the FortiAnalyzer/FortiManager CLI (or check the GUI dashboard) for the version. Affected: 8.0.0-8.0.1, 7.6.1-7.6.7 (Cloud 7.6.1-7.6.8, Cloud 8.0.0-8.0.1). 7.4 and 7.2 are not affected. Exploitation needs an authenticated privileged account; review who holds admin/JSON-RPC API access.

## Fix

Upgrade FortiAnalyzer and FortiManager 8.0.x to 8.0.2 or above; 7.6.x to 7.6.8 or above. Cloud 8.0 to 8.0.2 or above; Cloud 7.6 (7.6.1-7.6.8): migrate to a fixed release. 7.4 and 7.2 are not affected.

## Timeline

- 2026-11-11T22:29:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126211
- 2026-11-11T22:42:59+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-231 — Read Fortinet PSIRT FG-IR-26-231 (CVE confirmed on page): affected/fixed versions, not exploited, no virtual patch. No workaround stated.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-231: Improper privilege management https://fortiguard.fortinet.com/psirt/FG-IR-26-231

## From the sources

A improper privilege management vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.1 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.1 through 7.6.8, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.1 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.1 through 7.6.8 may allow an authenticated privileged attacker to elevate their privileges via crafted JSON-RPC request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_