FORTIMANAGER · CVE-2026-126213 · Vendor
FIX → 8.0.2 · 7.6.8 · 7.4.12 (upcoming) +3 ✓ verified
Several Fortinet FortiAnalyzer and FortiManager releases, including their cloud versions, fail to neutralize special characters in SQL commands. An authenticated attacker can send crafted requests to run unauthorized SQL commands against the database.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running FortiManager or FortiAnalyzer (on-prem or Cloud) in the listed versions. Exploitation needs a logged-in account on the GUI, so exposure is highest where many users have accounts or the GUI is reachable from untrusted networks. Fortinet rates the impact as denial of service, CVSS 7.1. Teams without these products can skip it.
Not affected if unaffected-version
Who cares fortianalyzer, fortimanager, fortinet, self-hosted
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted requests.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
get system status8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0 (FortiManager) or 7.4.1 (others) through 7.4.11, 7.2.0 (FortiManager) or 7.2.1 (others) through 7.2.12Upgrade to 8.0.2 · 7.6.8 · 7.4.12 (upcoming) +3
8.0.2 (8.0), 7.6.8 (7.6), 7.4.12 (7.4), 7.2.13 (7.2)7.4.12 and 7.2.13 are marked upcoming by Fortinet