{"id":"CVE-2026-126220","kind":"vulnerability","aliases":["CVE-2026-126220"],"related":[],"title":"Fortinet FortiManager and FortiAnalyzer: authenticated admin can read/write files and run commands via crafted GUI requests","description":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.","summary":"FG-IR-26-236 (CWE-22 and CWE-74) in the GUI of FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud lets an authenticated administrator read or write arbitrary files or execute unauthorized code or commands via crafted GUI requests. CVSS 7.2. Fortinet lists it as not known exploited and found internally.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["8.0.1","7.6.8","7.4.12"],"affected":"8.0.0; 7.6.0 through 7.6.7; 7.4.0 through 7.4.11","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["8.0.1","7.6.8","7.4.12"],"affected":"8.0.0; 7.6.0 through 7.6.7; 7.4.0 through 7.4.11","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","network-management","self-hosted","vendor"],"not_affected_if":["auth-required","no-admin-access-exposed","other-versions"],"how_to_check":"Run 'get system status' in the CLI (or see System Settings > Dashboard) and compare the version. Affected: FortiManager/FortiAnalyzer 8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.11 (Cloud 7.4.1-7.4.11). 7.2 is not affected.","fix":"Upgrade to 8.0.1 or above (8.0), 7.6.8 or above (7.6), 7.4.12 or above (7.4). No workaround listed by Fortinet.","status":"open","published_at":"2026-11-11T22:17:19+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:33:35+00:00","updated_at":"2026-11-11T22:42:16+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiManager: authenticated admin can run commands via GUI requests","impact":"high","summary":"A command injection flaw in the FortiManager web interface lets a logged-in administrator read or write arbitrary files and run unauthorized commands on the device. The flaw is triggered by specially crafted requests sent to the GUI.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimanager","fortinet","network-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs unauthorized commands and reads or writes arbitrary files on the device","analyst_note":"Confirm the fixed versions and any vendor advisory from Fortinet PSIRT; the sources give only the affected ranges.","how_to_check":"- Check the FortiManager version under System Settings or with `get system status` in the CLI, and compare it with the affected ranges.\n- Affected: FortiManager 8.0.0, 7.6.0 through 7.6.7, and 7.4.0 through 7.4.11.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-admin-access-exposed","other-versions"],"who_is_affected":"Organizations running FortiManager 8.0.0, 7.6.0 through 7.6.7, or 7.4.0 through 7.4.11. The attacker needs an administrator account on the FortiManager GUI, so limiting admin accounts and restricting GUI access reduces exposure. Sources do not say whether a patch is available.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4581,"output_tokens":585,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and any vendor advisory from Fortinet PSIRT; the sources give only the affected ranges.","search":"'-126220':19A,22A '-2026':18A,21A '-22':41B '-236':39B '-74':44B '26':38B '7.2':76B '7.4.0':111C '7.4.11':113C '7.6.0':107C '7.6.7':109C '8.0.0':105C 'admin':6A 'administr':59B,118C 'allow':115C 'arbitrari':63B,123C 'authent':5A,58B,117C 'cloud':51B,55B 'code':68B,128C 'command':12A,70B,130C 'compon':99C 'craft':14A,72B,133C 'cve':17A,20A 'cvss':75B 'cwe':40B,43B 'downstream':98C 'element':92C 'execut':66B,126C 'exploit':83B 'fg':36B 'fg-ir':35B 'file':9A,64B,124C 'fortianalyz':4A,25B,52B,54B 'fortianalyzer':24A 'fortimanag':2A,26B,49B,50B,104C,106C,110C 'fortimanager':23A 'fortinet':1A,27B,77B,103C 'found':85B 'gui':15A,47B,73B,137C 'host':33B 'improp':88C 'inject':100C 'intern':86B 'ir':37B 'known':82B 'let':56B 'list':78B 'manag':30B 'may':114C 'network':29B 'network-manag':28B 'neutral':89C 'output':94C 'read':60B,120C 'read/write':8A 'request':16A,74B,134C 'run':11A 'self':32B 'self-host':31B 'special':91C,132C 'unauthor':67B,127C 'use':95C 'vendor':34B 'via':13A,71B,131C 'vulner':101C 'write':62B,122C","nicknames":[],"mitigations":[],"who_affected":"Any FortiManager, FortiAnalyzer or their Cloud variants on 8.0.0, 7.6.0-7.6.7 or 7.4.x up to 7.4.11 are affected. The attacker needs an authenticated administrator account on the GUI, so exposure is highest where admin credentials are shared, weak or the GUI is reachable from untrusted networks. FortiManager/FortiAnalyzer 7.2 is not affected.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:42:16Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236","run_id":3639},"products":{"at":"2026-11-11T22:42:16Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236","run_id":3639},"how_to_check":{"at":"2026-11-11T22:42:16Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236","run_id":3639},"who_affected":{"at":"2026-11-11T22:42:16Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236","run_id":3639}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortianalyzer","fortimanager"],"ptokens":["fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","networkmanagement","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126220':19A,22A '-2026':18A,21A 'admin':6A 'authent':5A 'command':12A 'craft':14A 'cve':17A,20A 'file':9A 'fortianalyz':4A 'fortianalyzer':24A 'fortimanag':2A 'fortimanager':23A 'fortinet':1A 'gui':15A 'read/write':8A 'request':16A 'run':11A 'via':13A","search_b":"'-22':41B '-236':39B '-74':44B '26':38B '7.2':76B 'administr':59B 'arbitrari':63B 'authent':58B 'cloud':51B,55B 'code':68B 'command':70B 'craft':72B 'cvss':75B 'cwe':40B,43B 'execut':66B 'exploit':83B 'fg':36B 'fg-ir':35B 'file':64B 'fortianalyz':25B,52B,54B 'fortimanag':26B,49B,50B 'fortinet':27B,77B 'found':85B 'gui':47B,73B 'host':33B 'intern':86B 'ir':37B 'known':82B 'let':56B 'list':78B 'manag':30B 'network':29B 'network-manag':28B 'read':60B 'request':74B 'self':32B 'self-host':31B 'unauthor':67B 'vendor':34B 'via':71B 'write':62B","search_c":"'7.4.0':111C '7.4.11':113C '7.6.0':107C '7.6.7':109C '8.0.0':105C 'administr':118C 'allow':115C 'arbitrari':123C 'authent':117C 'code':128C 'command':130C 'compon':99C 'craft':133C 'downstream':98C 'element':92C 'execut':126C 'file':124C 'fortimanag':104C,106C,110C 'fortinet':103C 'gui':137C 'improp':88C 'inject':100C 'may':114C 'neutral':89C 'output':94C 'read':120C 'request':134C 'special':91C,132C 'unauthor':127C 'use':95C 'via':131C 'vulner':101C 'write':122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126220","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126220","severity":null,"published_at":"2026-11-11T22:17:19+00:00","modified_at":"2026-11-11T22:17:19+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126220:3639","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236","severity":null,"published_at":"2026-11-11T22:42:16+00:00","modified_at":"2026-11-11T22:42:16+00:00","first_seen_at":"2026-11-11T22:42:16+00:00","fetched_at":"2026-11-11T22:42:16+00:00","note":"Fortinet PSIRT FG-IR-26-236 (lists this CVE with 126219/126221) read: fixed versions and affected ranges confirmed; not exploited per vendor; discovered internally.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-236"]}],"documents":[{"id":129692,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236","title":"Fortinet PSIRT FG-IR-26-236","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}