{"id":"CVE-2026-126212","kind":"vulnerability","aliases":["CVE-2026-126212"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: heap overflow lets admins run code","description":"A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests.","summary":"A heap-based buffer overflow in FortiAnalyzer and FortiManager, triggered by specially crafted JSON-RPC requests, can be abused by an authenticated administrator. A successful attack can execute unauthorized code or commands or cause a denial of service.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["8.0.2","7.6.8","7.4.12"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11","ecosystem":"vendor"},{"name":"FortiManager","fixed":["8.0.2","7.6.8","7.4.12"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["8.0.2","7.6.8","7.4.12"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["8.0.2","7.6.8","7.4.12"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["patched","version-7.2","versions-outside-listed-ranges"],"how_to_check":"Run 'get system status' on the FortiAnalyzer/FortiManager CLI (or check the dashboard) for the firmware version. Exposed if 8.0.0-8.0.1, 7.6.0-7.6.7 or 7.4.0-7.4.11 (Cloud 7.4 from 7.4.1). Attacker needs an administrator account with JSON-RPC access; restrict admin access to trusted hosts meanwhile.","fix":"Upgrade FortiAnalyzer/FortiManager (and Cloud variants) to 8.0.2, 7.6.8 or 7.4.12 or later, per branch. 7.2 is not affected.","status":"open","published_at":"2026-11-11T22:17:18+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:33:38+00:00","updated_at":"2026-11-11T22:43:17+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: heap overflow lets admins run code","impact":"high","summary":"A heap-based buffer overflow in FortiAnalyzer and FortiManager, triggered by specially crafted JSON-RPC requests, can be abused by an authenticated administrator. A successful attack can execute unauthorized code or commands or cause a denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Administrator can execute unauthorized code or commands on the appliance","analyst_note":"Find the vendor advisory and the fixed versions for each FortiAnalyzer and FortiManager branch; the NVD entry gives none.","how_to_check":"- Check the installed FortiAnalyzer or FortiManager firmware version against the affected ranges in the sources (8.0.0 to 8.0.1, 7.6.0 to 7.6.7, 7.4.0 to 7.4.11, including the Cloud variants).\n- Note that the attacker must hold administrator credentials; the sources do not say how to check for prior abuse.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-listed-ranges"],"who_is_affected":"Organizations running FortiAnalyzer, FortiAnalyzer Cloud, FortiManager or FortiManager Cloud in the listed version ranges. Exposure depends on who holds administrator accounts on these management appliances; the sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000795,"input_tokens":4834,"output_tokens":624,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the fixed versions for each FortiAnalyzer and FortiManager branch; the NVD entry gives none.","search":"'-126212':13A,16A '-2026':12A,15A '7.4.0':88C,115C '7.4.1':103C,130C '7.4.11':90C,105C,117C,132C '7.6.0':84C,98C,111C,125C '7.6.7':86C,100C,113C,127C '8.0.0':80C,93C,107C,120C '8.0.1':82C,95C,109C,122C 'abus':50B 'admin':8A 'administr':54B,137C 'allow':134C 'attack':57B 'authent':53B,136C 'base':33B,73C 'buffer':34B,74C 'caus':65B,145C 'cloud':20A,22A,92C,97C,102C,119C,124C,129C 'code':10A,61B,141C 'command':63B,143C 'craft':43B,152C 'cve':11A,14A 'denial':67B,147C 'execut':59B,139C 'fortianalyz':2A,23B,37B,79C,83C,87C,91C,96C,101C 'fortianalyzer':17A,19A 'fortimanag':4A,24B,39B,106C,110C,114C,118C,123C,128C 'fortimanager':18A,21A 'fortinet':1A,25B,78C 'heap':5A,32B,72C 'heap-bas':31B,71C 'host':28B 'json':45B,154C 'json-rpc':44B,153C 'let':7A 'may':133C 'overflow':6A,35B,75C 'request':47B,156C 'rpc':46B,155C 'run':9A 'self':27B 'self-host':26B 'servic':69B,149C 'special':42B,151C 'success':56B 'trigger':40B 'unauthor':60B,140C 'vendor':29B 'via':150C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted FortiAnalyzer or FortiManager, or the Cloud variants, on 7.4, 7.6 or 8.0 branches below the fixed releases. An authenticated administrator can send crafted JSON-RPC requests to run code or crash the service. 7.2 branches are not affected by the vendor.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:43:17Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-232","run_id":3644},"products":{"at":"2026-11-11T22:43:17Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-232","run_id":3644},"who_affected":{"at":"2026-11-11T22:43:17Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-232","run_id":3644}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126212':13A,16A '-2026':12A,15A 'admin':8A 'cloud':20A,22A 'code':10A 'cve':11A,14A 'fortianalyz':2A 'fortianalyzer':17A,19A 'fortimanag':4A 'fortimanager':18A,21A 'fortinet':1A 'heap':5A 'let':7A 'overflow':6A 'run':9A","search_b":"'abus':50B 'administr':54B 'attack':57B 'authent':53B 'base':33B 'buffer':34B 'caus':65B 'code':61B 'command':63B 'craft':43B 'denial':67B 'execut':59B 'fortianalyz':23B,37B 'fortimanag':24B,39B 'fortinet':25B 'heap':32B 'heap-bas':31B 'host':28B 'json':45B 'json-rpc':44B 'overflow':35B 'request':47B 'rpc':46B 'self':27B 'self-host':26B 'servic':69B 'special':42B 'success':56B 'trigger':40B 'unauthor':60B 'vendor':29B","search_c":"'7.4.0':88C,115C '7.4.1':103C,130C '7.4.11':90C,105C,117C,132C '7.6.0':84C,98C,111C,125C '7.6.7':86C,100C,113C,127C '8.0.0':80C,93C,107C,120C '8.0.1':82C,95C,109C,122C 'administr':137C 'allow':134C 'authent':136C 'base':73C 'buffer':74C 'caus':145C 'cloud':92C,97C,102C,119C,124C,129C 'code':141C 'command':143C 'craft':152C 'denial':147C 'execut':139C 'fortianalyz':79C,83C,87C,91C,96C,101C 'fortimanag':106C,110C,114C,118C,123C,128C 'fortinet':78C 'heap':72C 'heap-bas':71C 'json':154C 'json-rpc':153C 'may':133C 'overflow':75C 'request':156C 'rpc':155C 'servic':149C 'special':151C 'unauthor':140C 'via':150C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126212","severity":null,"published_at":"2026-11-11T22:17:18+00:00","modified_at":"2026-11-11T22:17:18+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126212:3644","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-232","severity":null,"published_at":"2026-11-11T22:43:17+00:00","modified_at":"2026-11-11T22:43:17+00:00","first_seen_at":"2026-11-11T22:43:17+00:00","fetched_at":"2026-11-11T22:43:17+00:00","note":"Fortinet FG-IR-26-232 read: affected/fixed per branch from vendor table; 7.2 not affected; no exploitation reported (CISecurity), no PoC seen.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-232","https://www.tenable.com/plugins/nessus/378631"]}],"documents":[{"id":129697,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-232","title":"FG-IR-26-232 Heap-based buffer overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":129698,"url":"https://www.tenable.com/plugins/nessus/378631","title":"Tenable plugin FG-IR-26-232","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}