{"id":"CVE-2026-126217","kind":"vulnerability","aliases":["CVE-2026-126217"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: authenticated admins can escalate privileges","description":"A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.","summary":"Several Fortinet FortiAnalyzer and FortiManager versions have an incorrect authorization flaw in the web GUI. A logged-in administrator could escalate privileges, bypass authorization controls or impersonate internal services.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["no-admin-access-from-untrusted-users","versions-outside-listed-ranges"],"how_to_check":"- Check the installed version of FortiAnalyzer, FortiAnalyzer Cloud, FortiManager or FortiManager Cloud against the affected ranges listed in the advisory data\n- Confirm whether the GUI is reachable by administrators you do not fully trust","fix":"- Move to a fixed release; the sources do not name the fixed version numbers for each branch","status":"open","published_at":"2026-11-11T22:17:19+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:31:24+00:00","updated_at":"2026-11-11T22:31:24+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-11T22:31:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed release; the sources do not name the fixed version numbers for each branch","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: authenticated admins can escalate privileges","impact":"high","summary":"Several Fortinet FortiAnalyzer and FortiManager versions have an incorrect authorization flaw in the web GUI. A logged-in administrator could escalate privileges, bypass authorization controls or impersonate internal services.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"admin gains wider privileges and reaches internal services","analyst_note":"Find Fortinet's PSIRT advisory for CVE-2026-126217 to confirm fixed versions per branch and whether the flaw is exploited.","how_to_check":"- Check the installed version of FortiAnalyzer, FortiAnalyzer Cloud, FortiManager or FortiManager Cloud against the affected ranges listed in the advisory data\n- Confirm whether the GUI is reachable by administrators you do not fully trust","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-listed-ranges","no-admin-access-from-untrusted-users"],"who_is_affected":"Organisations running FortiAnalyzer or FortiManager, on-premises or in the Cloud versions, within the listed 7.2, 7.4, 7.6 and 8.0 ranges. The attacker must already hold a valid administrator login, so exposure depends on who has admin accounts and whether the GUI is reachable from untrusted networks.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000823,"input_tokens":4929,"output_tokens":661,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126217':12A,15A '-2026':11A,14A '7.2.0':72C,108C '7.2.1':92C,128C '7.2.12':74C,94C,110C,130C '7.4.0':68C,104C '7.4.1':87C,123C '7.4.11':70C,89C,106C,125C '7.6.0':64C,82C,100C,118C '7.6.7':66C,84C,102C,120C '8.0.0':60C,77C,96C,113C '8.0.1':62C,79C,98C,115C 'admin':6A 'administr':42B,135C 'allow':132C 'authent':5A,134C 'author':32B,47B,55C,141C 'bypass':46B,140C 'cloud':76C,81C,86C,91C,112C,117C,122C,127C 'control':48B,142C 'could':43B 'craft':149C 'cve':10A,13A 'escal':8A,44B,137C 'flaw':33B 'fortianalyz':2A,16B,25B,59C,63C,67C,71C,75C,80C,85C,90C 'fortimanag':4A,17B,27B,95C,99C,103C,107C,111C,116C,121C,126C 'fortinet':1A,18B,24B,58C 'gui':37B,153C 'host':21B 'imperson':50B,144C 'incorrect':31B,54C 'intern':51B,145C 'log':40B 'logged-in':39B 'may':131C 'privileg':9A,45B,139C 'request':150C 'self':20B 'self-host':19B 'servic':52B,146C 'sever':23B 'special':148C 'vendor':22B 'version':28B 'via':147C 'vulner':56C 'web':36B","nicknames":[],"mitigations":[],"who_affected":"Organisations running FortiAnalyzer or FortiManager, on-premises or in the Cloud versions, within the listed 7.2, 7.4, 7.6 and 8.0 ranges. The attacker must already hold a valid administrator login, so exposure depends on who has admin accounts and whether the GUI is reachable from untrusted networks.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fortianalyzer","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126217':12A,15A '-2026':11A,14A 'admin':6A 'authent':5A 'cve':10A,13A 'escal':8A 'fortianalyz':2A 'fortimanag':4A 'fortinet':1A 'privileg':9A","search_b":"'administr':42B 'author':32B,47B 'bypass':46B 'control':48B 'could':43B 'escal':44B 'flaw':33B 'fortianalyz':16B,25B 'fortimanag':17B,27B 'fortinet':18B,24B 'gui':37B 'host':21B 'imperson':50B 'incorrect':31B 'intern':51B 'log':40B 'logged-in':39B 'privileg':45B 'self':20B 'self-host':19B 'servic':52B 'sever':23B 'vendor':22B 'version':28B 'web':36B","search_c":"'7.2.0':72C,108C '7.2.1':92C,128C '7.2.12':74C,94C,110C,130C '7.4.0':68C,104C '7.4.1':87C,123C '7.4.11':70C,89C,106C,125C '7.6.0':64C,82C,100C,118C '7.6.7':66C,84C,102C,120C '8.0.0':60C,77C,96C,113C '8.0.1':62C,79C,98C,115C 'administr':135C 'allow':132C 'authent':134C 'author':55C,141C 'bypass':140C 'cloud':76C,81C,86C,91C,112C,117C,122C,127C 'control':142C 'craft':149C 'escal':137C 'fortianalyz':59C,63C,67C,71C,75C,80C,85C,90C 'fortimanag':95C,99C,103C,107C,111C,116C,121C,126C 'fortinet':58C 'gui':153C 'imperson':144C 'incorrect':54C 'intern':145C 'may':131C 'privileg':139C 'request':150C 'servic':146C 'special':148C 'via':147C 'vulner':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126217","severity":null,"published_at":"2026-11-11T22:17:19+00:00","modified_at":"2026-11-11T22:17:19+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}