FORTIMANAGER · CVE-2026-126219 · Vendor
FIX → 8.0.1 · 7.6.8 +1 ✓ verified
A path traversal flaw in Fortinet FortiAnalyzer and FortiManager lets a logged-in administrator read or write arbitrary files and possibly run unauthorized code through crafted GUI requests. The sources list affected versions across the 7.4, 7.6 and 8.0 branches, including the cloud editions.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running FortiAnalyzer or FortiManager (on-premises or Cloud) on 7.4, 7.6 or 8.0 below the fixed releases. An attacker needs a valid administrator login to the GUI, then uses crafted requests to read or write files or run unauthorized code or commands. Teams on 7.2 can skip it; it matters most where admin accounts are shared or the GUI is reachable from untrusted networks.
Not affected if gui-not-exposed, version-7.2, versions-outside-range
Who cares fortianalyzer, fortimanager, fortinet, network-security, self-hosted
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
get system status)8.0.0, 7.6.0-7.6.7, or 7.4.0-7.4.11 (Cloud 7.4 from 7.4.1). 7.2 is not affectedUpgrade to 8.0.1 · 7.6.8 +1
8.0.1 or above on 8.0, 7.6.8 or above on 7.6, 7.4.12 or above on 7.4