---
id: "CVE-2026-126213"
page: "https://infrastack.ai/live/CVE-2026-126213"
kind: "vulnerability"
aliases: ["CVE-2026-126213"]
title: "Fortinet FortiAnalyzer and FortiManager: SQL injection lets a logged-in user run SQL"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiManager", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["8.0.2", "7.6.8", "7.4.12 (upcoming)", "7.2.13 (upcoming)"], "affected": "8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12 (upcoming)", "7.2.13 (upcoming)"], "affected": "8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12 (upcoming)", "7.2.13 (upcoming)"], "affected": "8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-11T22:17:18+00:00"
first_seen_at: "2026-11-11T22:29:30+00:00"
updated_at: "2026-11-11T22:43:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126213", "first_seen_at": "2026-11-11T22:29:30+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-233", "first_seen_at": "2026-11-11T22:43:00+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-233"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: SQL injection lets a logged-in user run SQL

Link for people: https://infrastack.ai/live/CVE-2026-126213 (this .md is for agents)

Several Fortinet FortiAnalyzer and FortiManager releases, including their cloud versions, fail to neutralize special characters in SQL commands. An authenticated attacker can send crafted requests to run unauthorized SQL commands against the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected 8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiAnalyzer affected 8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12 fixed 8.0.2, 7.6.8, 7.4.12 (upcoming), 7.2.13 (upcoming)
- vendor:FortiManager Cloud affected 8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12 fixed 8.0.2, 7.6.8, 7.4.12 (upcoming), 7.2.13 (upcoming)
- vendor:FortiAnalyzer Cloud affected 8.0.0-8.0.1; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12 fixed 8.0.2, 7.6.8, 7.4.12 (upcoming), 7.2.13 (upcoming)

## How to check

Check version in the FortiManager or FortiAnalyzer GUI Dashboard System Information, or CLI 'get system status'. Exposed if it is in: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0 (FortiManager) or 7.4.1 (others) through 7.4.11, 7.2.0 (FortiManager) or 7.2.1 (others) through 7.2.12. Cloud variants follow the same ranges; Fortinet manages versions there but confirm in the console.

## Fix

Upgrade to 8.0.2 (8.0), 7.6.8 (7.6), 7.4.12 (7.4), 7.2.13 (7.2). For FortiAnalyzer, FortiAnalyzer Cloud, FortiManager Cloud 7.4 and 7.2 the fixes 7.4.12 and 7.2.13 are marked upcoming by Fortinet. No workaround is listed.

## Timeline

- 2026-11-11T22:29:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126213
- 2026-11-11T22:43:00+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-233 — Read Fortinet PSIRT FG-IR-26-233: authenticated SQLi in GUI, no known exploitation, no virtual patch, no workaround listed. Fixed 8.0.2/7.6.8 now; FortiManager 7.4.12/7.2.13 listed as fixes; FortiAnalyzer and Cloud 7.4.12/7.2.13 upcoming. NVD says FortiAnalyzer 7.4/7.2 all versions, PSIRT says 7.4.1-7.4.11 and 7.2.1-7.2.12.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-233: SQL injection in FortiManager/FortiAnalyzer GUI https://fortiguard.fortinet.com/psirt/FG-IR-26-233

## From the sources

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_