---
id: "CVE-2026-126221"
page: "https://infrastack.ai/live/CVE-2026-126221"
kind: "vulnerability"
aliases: ["CVE-2026-126221"]
title: "Fortinet FortiAnalyzer and FortiManager: admin requests can read, write or run code"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiManager", "fixed": ["8.0.1", "7.6.8", "7.4.12"], "affected": "8.0.0; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["8.0.1", "7.6.8", "7.4.12"], "affected": "8.0.0; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["8.0.1", "7.6.8", "7.4.12"], "affected": "8.0.0; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["8.0.1", "7.6.8", "7.4.12"], "affected": "8.0.0; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "versions-outside-ranges"]
published_at: "2026-11-11T22:17:19+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:42:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126221", "first_seen_at": "2026-11-11T22:29:31+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-236", "first_seen_at": "2026-11-11T22:42:16+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-236"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: admin requests can read, write or run code

Link for people: https://infrastack.ai/live/CVE-2026-126221 (this .md is for agents)

Fortinet FortiAnalyzer and FortiManager fail to neutralize special characters in output passed to a downstream component, an injection flaw. An authenticated administrator who sends specially crafted requests to the GUI may read or write arbitrary files or run unauthorized code or commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected 8.0.0; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11 fixed 8.0.1, 7.6.8, 7.4.12
- vendor:FortiAnalyzer affected 8.0.0; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11 fixed 8.0.1, 7.6.8, 7.4.12
- vendor:FortiManager Cloud affected 8.0.0; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11 fixed 8.0.1, 7.6.8, 7.4.12
- vendor:FortiAnalyzer Cloud affected 8.0.0; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11 fixed 8.0.1, 7.6.8, 7.4.12

## How to check

Check the version (GUI dashboard or CLI 'get system status') on each FortiManager, FortiAnalyzer, and Cloud edition. Affected: 8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.11 (Cloud editions: 7.4.1-7.4.11). 7.2 is not affected. Also review the list of administrator accounts and restrict GUI access to trusted networks, since exploitation needs an authenticated admin.

## Fix

Upgrade FortiManager/FortiAnalyzer (and Cloud editions) to 8.0.1 (from 8.0.0), 7.6.8 (from 7.6.0-7.6.7), or 7.4.12 (from 7.4.0-7.4.11). 7.2 is not affected.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126221
- 2026-11-11T22:42:16+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-236 — Read Fortinet FG-IR-26-236 (covers CVE-2026-126219/20/21): versions, fixes, not exploited. No workaround listed. No PoC; no social search done (B tier, low chatter expected).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-236 https://fortiguard.fortinet.com/psirt/FG-IR-26-236

## From the sources

A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_