---
id: "CVE-2026-126220"
page: "https://infrastack.ai/live/CVE-2026-126220"
kind: "vulnerability"
aliases: ["CVE-2026-126220"]
title: "Fortinet FortiManager and FortiAnalyzer: authenticated admin can read/write files and run commands via crafted GUI requests"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiManager", "fixed": ["8.0.1", "7.6.8", "7.4.12"], "affected": "8.0.0; 7.6.0 through 7.6.7; 7.4.0 through 7.4.11", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["8.0.1", "7.6.8", "7.4.12"], "affected": "8.0.0; 7.6.0 through 7.6.7; 7.4.0 through 7.4.11", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "network-management", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "no-admin-access-exposed", "other-versions"]
published_at: "2026-11-11T22:17:19+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:42:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126220", "first_seen_at": "2026-11-11T22:29:31+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-236", "first_seen_at": "2026-11-11T22:42:16+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-236"]}]
exploit_sources: []
---

# Fortinet FortiManager and FortiAnalyzer: authenticated admin can read/write files and run commands via crafted GUI requests

Link for people: https://infrastack.ai/live/CVE-2026-126220 (this .md is for agents)

FG-IR-26-236 (CWE-22 and CWE-74) in the GUI of FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud lets an authenticated administrator read or write arbitrary files or execute unauthorized code or commands via crafted GUI requests. CVSS 7.2. Fortinet lists it as not known exploited and found internally.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected 8.0.0; 7.6.0 through 7.6.7; 7.4.0 through 7.4.11 fixed 8.0.1, 7.6.8, 7.4.12
- vendor:FortiAnalyzer affected 8.0.0; 7.6.0 through 7.6.7; 7.4.0 through 7.4.11 fixed 8.0.1, 7.6.8, 7.4.12

## How to check

Run 'get system status' in the CLI (or see System Settings > Dashboard) and compare the version. Affected: FortiManager/FortiAnalyzer 8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.11 (Cloud 7.4.1-7.4.11). 7.2 is not affected.

## Fix

Upgrade to 8.0.1 or above (8.0), 7.6.8 or above (7.6), 7.4.12 or above (7.4). No workaround listed by Fortinet.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126220
- 2026-11-11T22:42:16+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-236 — Fortinet PSIRT FG-IR-26-236 (lists this CVE with 126219/126221) read: fixed versions and affected ranges confirmed; not exploited per vendor; discovered internally.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-236 https://fortiguard.fortinet.com/psirt/FG-IR-26-236

## From the sources

A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_