{"id":"CVE-2026-126213","kind":"vulnerability","aliases":["CVE-2026-126213"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: SQL injection lets a logged-in user run SQL","description":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted requests.","summary":"Several Fortinet FortiAnalyzer and FortiManager releases, including their cloud versions, fail to neutralize special characters in SQL commands. An authenticated attacker can send crafted requests to run unauthorized SQL commands against the database.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["8.0.2","7.6.8","7.4.12 (upcoming)","7.2.13 (upcoming)"],"affected":"8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["8.0.2","7.6.8","7.4.12 (upcoming)","7.2.13 (upcoming)"],"affected":"8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["8.0.2","7.6.8","7.4.12 (upcoming)","7.2.13 (upcoming)"],"affected":"8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"Check version in the FortiManager or FortiAnalyzer GUI Dashboard System Information, or CLI 'get system status'. Exposed if it is in: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0 (FortiManager) or 7.4.1 (others) through 7.4.11, 7.2.0 (FortiManager) or 7.2.1 (others) through 7.2.12. Cloud variants follow the same ranges; Fortinet manages versions there but confirm in the console.","fix":"Upgrade to 8.0.2 (8.0), 7.6.8 (7.6), 7.4.12 (7.4), 7.2.13 (7.2). For FortiAnalyzer, FortiAnalyzer Cloud, FortiManager Cloud 7.4 and 7.2 the fixes 7.4.12 and 7.2.13 are marked upcoming by Fortinet. No workaround is listed.","status":"open","published_at":"2026-11-11T22:17:18+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:33:57+00:00","updated_at":"2026-11-11T22:43:00+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:33:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: SQL injection lets a logged-in user run SQL","impact":"high","summary":"Several Fortinet FortiAnalyzer and FortiManager releases, including their cloud versions, fail to neutralize special characters in SQL commands. An authenticated attacker can send crafted requests to run unauthorized SQL commands against the database.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs unauthorized SQL commands against the management database","analyst_note":"Confirm the fixed versions for each affected branch and whether the vendor advisory names a setting or patch, from the Fortinet PSIRT page for this CVE.","how_to_check":"- Check the installed FortiAnalyzer or FortiManager version in the admin interface against the affected ranges in the sources.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running Fortinet FortiAnalyzer or FortiManager, on-premises or as Fortinet cloud services, on the affected version ranges listed in the sources. The sources do not say which configurations are exposed, so the exposure of a given deployment is unknown. Teams running other Fortinet products can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4891,"output_tokens":559,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions for each affected branch and whether the vendor advisory names a setting or patch, from the Fortinet PSIRT page for this CVE.","search":"'-126213':17A,20A '-2026':16A,19A '7.2':96C '7.2.0':132C '7.2.1':116C,152C '7.2.12':118C,134C,154C '7.4':92C '7.4.0':128C '7.4.1':111C,147C '7.4.11':113C,130C,149C '7.6.0':88C,106C,124C,142C '7.6.7':90C,108C,126C,144C '8.0.0':84C,101C,120C,137C '8.0.1':86C,103C,122C,139C 'allow':156C 'attack':54B,159C 'authent':53B,158C 'charact':48B 'cloud':24A,26A,42B,100C,105C,110C,115C,136C,141C,146C,151C 'command':51B,63B,77C,164C 'craft':57B,167C 'cve':15A,18A 'databas':66B 'element':72C 'execut':161C 'fail':44B 'fortianalyz':2A,27B,36B,83C,87C,91C,95C,99C,104C,109C,114C 'fortianalyzer':22A,25A 'fortimanag':4A,28B,38B,119C,123C,127C,131C,135C,140C,145C,150C 'fortimanager':21A,23A 'fortinet':1A,29B,35B,82C 'host':32B 'improp':68C 'includ':40B 'inject':6A,79C 'let':7A 'log':10A 'logged-in':9A 'may':155C 'neutral':46B,69C 'releas':39B 'request':58B,168C 'run':13A,60B 'self':31B 'self-host':30B 'send':56B 'sever':34B 'special':47B,71C,166C 'sql':5A,14A,50B,62B,76C,78C,163C 'unauthor':61B,162C 'use':73C 'user':12A 'vendor':33B 'version':43B,94C,98C 'via':165C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiManager or FortiAnalyzer (on-prem or Cloud) in the listed versions. Exploitation needs a logged-in account on the GUI, so exposure is highest where many users have accounts or the GUI is reachable from untrusted networks. Fortinet rates the impact as denial of service, CVSS 7.1. Teams without these products can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:43:00Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-233","run_id":3643},"products":{"at":"2026-11-11T22:43:00Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-233","run_id":3643},"how_to_check":{"at":"2026-11-11T22:43:00Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-233","run_id":3643}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126213':17A,20A '-2026':16A,19A 'cloud':24A,26A 'cve':15A,18A 'fortianalyz':2A 'fortianalyzer':22A,25A 'fortimanag':4A 'fortimanager':21A,23A 'fortinet':1A 'inject':6A 'let':7A 'log':10A 'logged-in':9A 'run':13A 'sql':5A,14A 'user':12A","search_b":"'attack':54B 'authent':53B 'charact':48B 'cloud':42B 'command':51B,63B 'craft':57B 'databas':66B 'fail':44B 'fortianalyz':27B,36B 'fortimanag':28B,38B 'fortinet':29B,35B 'host':32B 'includ':40B 'neutral':46B 'releas':39B 'request':58B 'run':60B 'self':31B 'self-host':30B 'send':56B 'sever':34B 'special':47B 'sql':50B,62B 'unauthor':61B 'vendor':33B 'version':43B","search_c":"'7.2':96C '7.2.0':132C '7.2.1':116C,152C '7.2.12':118C,134C,154C '7.4':92C '7.4.0':128C '7.4.1':111C,147C '7.4.11':113C,130C,149C '7.6.0':88C,106C,124C,142C '7.6.7':90C,108C,126C,144C '8.0.0':84C,101C,120C,137C '8.0.1':86C,103C,122C,139C 'allow':156C 'attack':159C 'authent':158C 'cloud':100C,105C,110C,115C,136C,141C,146C,151C 'command':77C,164C 'craft':167C 'element':72C 'execut':161C 'fortianalyz':83C,87C,91C,95C,99C,104C,109C,114C 'fortimanag':119C,123C,127C,131C,135C,140C,145C,150C 'fortinet':82C 'improp':68C 'inject':79C 'may':155C 'neutral':69C 'request':168C 'special':71C,166C 'sql':76C,78C,163C 'unauthor':162C 'use':73C 'version':94C,98C 'via':165C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126213","severity":null,"published_at":"2026-11-11T22:17:18+00:00","modified_at":"2026-11-11T22:17:18+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126213:3643","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-233","severity":null,"published_at":"2026-11-11T22:43:00+00:00","modified_at":"2026-11-11T22:43:00+00:00","first_seen_at":"2026-11-11T22:43:00+00:00","fetched_at":"2026-11-11T22:43:00+00:00","note":"Read Fortinet PSIRT FG-IR-26-233: authenticated SQLi in GUI, no known exploitation, no virtual patch, no workaround listed. Fixed 8.0.2/7.6.8 now; FortiManager 7.4.12/7.2.13 listed as fixes; FortiAnalyzer and Cloud 7.4.12/7.2.13 upcoming. NVD says FortiAnalyzer 7.4/7.2 all versions, PSIRT says 7.4.1-7.4.11 and 7.2.1-7.2.12.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-233"]}],"documents":[{"id":129695,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-233","title":"Fortinet PSIRT FG-IR-26-233: SQL injection in FortiManager/FortiAnalyzer GUI","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}