FORTIANALYZER · CVE-2026-126212 · Vendor
FIX → 8.0.2 · 7.6.8 +1 ✓ verified
A heap-based buffer overflow in FortiAnalyzer and FortiManager, triggered by specially crafted JSON-RPC requests, can be abused by an authenticated administrator. A successful attack can execute unauthorized code or commands or cause a denial of service.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-hosted FortiAnalyzer or FortiManager, or the Cloud variants, on 7.4, 7.6 or 8.0 branches below the fixed releases. An authenticated administrator can send crafted JSON-RPC requests to run code or crash the service. 7.2 branches are not affected by the vendor.
Not affected if patched, version-7.2, versions-outside-listed-ranges
Who cares fortianalyzer, fortimanager, fortinet, self-hosted
A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
get system status8.0.0-8.0.1, 7.6.0-7.6.7 or 7.4.0-7.4.11 (Cloud 7.4 from 7.4.1)Upgrade to 8.0.2 · 7.6.8 +1
Upgrade FortiAnalyzer/FortiManager (and Cloud variants) to 8.0.2, 7.6.8 or 7.4.12 or later, per branch. 7.2 is not affected.