---
id: "CVE-2026-126212"
page: "https://infrastack.ai/live/CVE-2026-126212"
kind: "vulnerability"
aliases: ["CVE-2026-126212"]
title: "Fortinet FortiAnalyzer and FortiManager: heap overflow lets admins run code"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAnalyzer", "fixed": ["8.0.2", "7.6.8", "7.4.12"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["8.0.2", "7.6.8", "7.4.12"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["patched", "version-7.2", "versions-outside-listed-ranges"]
published_at: "2026-11-11T22:17:18+00:00"
first_seen_at: "2026-11-11T22:29:30+00:00"
updated_at: "2026-11-11T22:43:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126212", "first_seen_at": "2026-11-11T22:29:30+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-232", "first_seen_at": "2026-11-11T22:43:17+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-232", "https://www.tenable.com/plugins/nessus/378631"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: heap overflow lets admins run code

Link for people: https://infrastack.ai/live/CVE-2026-126212 (this .md is for agents)

A heap-based buffer overflow in FortiAnalyzer and FortiManager, triggered by specially crafted JSON-RPC requests, can be abused by an authenticated administrator. A successful attack can execute unauthorized code or commands or cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11 fixed 8.0.2, 7.6.8, 7.4.12
- vendor:FortiManager affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11 fixed 8.0.2, 7.6.8, 7.4.12
- vendor:FortiAnalyzer Cloud affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11 fixed 8.0.2, 7.6.8, 7.4.12
- vendor:FortiManager Cloud affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11 fixed 8.0.2, 7.6.8, 7.4.12

## How to check

Run 'get system status' on the FortiAnalyzer/FortiManager CLI (or check the dashboard) for the firmware version. Exposed if 8.0.0-8.0.1, 7.6.0-7.6.7 or 7.4.0-7.4.11 (Cloud 7.4 from 7.4.1). Attacker needs an administrator account with JSON-RPC access; restrict admin access to trusted hosts meanwhile.

## Fix

Upgrade FortiAnalyzer/FortiManager (and Cloud variants) to 8.0.2, 7.6.8 or 7.4.12 or later, per branch. 7.2 is not affected.

## Timeline

- 2026-11-11T22:29:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126212
- 2026-11-11T22:43:17+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-232 — Fortinet FG-IR-26-232 read: affected/fixed per branch from vendor table; 7.2 not affected; no exploitation reported (CISecurity), no PoC seen.

## Documents

- [advisory] FG-IR-26-232 Heap-based buffer overflow https://fortiguard.fortinet.com/psirt/FG-IR-26-232
- [mentions] Tenable plugin FG-IR-26-232 https://www.tenable.com/plugins/nessus/378631

## From the sources

A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_