FORTIMANAGER · CVE-2026-126220 · Vendor
FIX → 8.0.1 · 7.6.8 +1 ✓ verified
FG-IR-26-236 (CWE-22 and CWE-74) in the GUI of FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud lets an authenticated administrator read or write arbitrary files or execute unauthorized code or commands via crafted GUI requests. CVSS 7.2. Fortinet lists it as not known exploited and found internally.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any FortiManager, FortiAnalyzer or their Cloud variants on 8.0.0, 7.6.0-7.6.7 or 7.4.x up to 7.4.11 are affected. The attacker needs an authenticated administrator account on the GUI, so exposure is highest where admin credentials are shared, weak or the GUI is reachable from untrusted networks. FortiManager/FortiAnalyzer 7.2 is not affected.
Not affected if auth-required, no-admin-access-exposed, other-versions
Who cares fortianalyzer, fortimanager, fortinet, network-management, self-hosted
get system status in the CLI (or see System Settings > Dashboard) and compare the version8.0.0, , (Cloud ). 7.2 is not affectedA improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
7.6.0-7.6.77.4.0-7.4.117.4.1-7.4.11Upgrade to 8.0.1 · 7.6.8 +1
8.0.1 or above (8.0), 7.6.8 or above (7.6), 7.4.12 or above (7.4)