---
id: "CVE-2026-126215"
page: "https://infrastack.ai/live/CVE-2026-126215"
kind: "vulnerability"
aliases: ["CVE-2026-126215"]
title: "Fortinet FortiAnalyzer and FortiManager: admins can escalate privileges via GUI"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAnalyzer", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; >= 7.2.0, <= 7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; >= 7.2.0, <= 7.2.12", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11; >= 7.2.1, <= 7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11; >= 7.2.1, <= 7.2.12", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["no-admin-accounts-exposed", "versions-outside-range"]
published_at: "2026-11-11T22:17:18+00:00"
first_seen_at: "2026-11-11T22:29:30+00:00"
updated_at: "2026-11-11T22:43:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126215", "first_seen_at": "2026-11-11T22:29:30+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-234", "first_seen_at": "2026-11-11T22:43:10+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-234"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: admins can escalate privileges via GUI

Link for people: https://infrastack.ai/live/CVE-2026-126215 (this .md is for agents)

Fortinet's FortiAnalyzer and FortiManager management products have an incorrect authorization flaw in their web GUI. A logged-in administrator can craft requests to gain higher privileges, bypass access controls, or impersonate internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; >= 7.2.0, <= 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiManager affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; >= 7.2.0, <= 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiAnalyzer Cloud affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11; >= 7.2.1, <= 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiManager Cloud affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11; >= 7.2.1, <= 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13

## How to check

Get the version with 'get system status' on the FortiAnalyzer or FortiManager CLI (or the dashboard in the GUI). Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12; Cloud editions 7.4.1-7.4.11 and 7.2.1-7.2.12 plus the same 8.0 and 7.6 ranges. Fortinet's advisory also lists FortiAnalyzer-BigData and FortiSASE-Sovereign (25.x) for this advisory; the NVD record for this CVE does not name them, so check them too. No workaround listed by Fortinet. Also restrict GUI access to trusted admin networks and review who holds admin accounts.

## Fix

Upgrade FortiAnalyzer / FortiManager (and their Cloud editions) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or above, matching your branch.

## Timeline

- 2026-11-11T22:29:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126215
- 2026-11-11T22:43:10+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-234 — Fortinet PSIRT FG-IR-26-234 (covers CVE-2026-126214..126217, one advisory) lists fixed versions per branch; no workaround or virtual patch listed; Known Exploited: No. Advisory CVSS 8.7 vs NVD vector 8.2; severity left unchanged. X/Bluesky not searched (low-signal, not exploited).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-234: Incorrect authorization (CVE-2026-126214..126217) https://fortiguard.fortinet.com/psirt/FG-IR-26-234

## From the sources

A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_