{"id":"CVE-2026-126222","kind":"vulnerability","aliases":["CVE-2026-126222"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: path traversal lets admins run commands","description":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.3 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.3 through 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.3 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.3 through 7.6.7 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via crafted requests.","summary":"A path traversal flaw in Fortinet FortiAnalyzer, FortiManager and their cloud versions lets an authenticated admin escape a restricted directory. The sources say this can lead to unauthorized code or command execution on the appliance.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["7.6.8","8.0.2"],"affected":">= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["7.6.8","8.0.2"],"affected":">= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["7.6.8","8.0.2"],"affected":">= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["7.6.8","8.0.2"],"affected":">= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","fortianalyzer","fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["auth-required","no-admin-exposure","outside-listed-versions","version-7.4-or-older"],"how_to_check":"Run 'get system status' on the FortiManager/FortiAnalyzer CLI (or check the dashboard) for the firmware version. Exposed if it is 8.0.0-8.0.1 or 7.6.3-7.6.7. 7.4 and 7.2 are not affected. FortiManager Cloud and FortiAnalyzer Cloud are listed on the same ranges. The attacker needs an admin account, so also review who holds admin accounts and API access.","fix":"FortiManager/FortiAnalyzer (and Cloud) 8.0.x: upgrade to 8.0.2 or above; 7.6.x: upgrade to 7.6.8 or above. 7.4 and 7.2 are not affected.","status":"open","published_at":"2026-11-11T22:17:20+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:33:31+00:00","updated_at":"2026-11-11T22:41:06+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T22:33:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: path traversal lets admins run commands","impact":"high","summary":"A path traversal flaw in Fortinet FortiAnalyzer, FortiManager and their cloud versions lets an authenticated admin escape a restricted directory. The sources say this can lead to unauthorized code or command execution on the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"admin attacker runs unauthorized commands on the appliance","analyst_note":"Check the Fortinet PSIRT advisory for the fixed versions and any workaround; the NVD entry gives no fix or exploitation detail.","how_to_check":"- Check the running version of FortiAnalyzer or FortiManager against the affected ranges: 8.0.0 through 8.0.1 and 7.6.3 through 7.6.7.\n- Confirm whether the cloud variants (FortiAnalyzer Cloud, FortiManager Cloud) are in use on the same version ranges.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-listed-versions","no-admin-exposure"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager, on-premises or cloud, in the listed 8.0.0 to 8.0.1 and 7.6.3 to 7.6.7 ranges. The attacker must already hold admin privileges on the product, so exposure depends on how many admin accounts exist and who can reach the admin interface. Teams on other versions or without these products can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000797,"input_tokens":4716,"output_tokens":650,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for the fixed versions and any workaround; the NVD entry gives no fix or exploitation detail.","search":"'-126222':13A,16A '-2026':12A,15A '7.6.3':88C,98C,106C,116C '7.6.7':90C,100C,108C,118C '8.0.0':84C,93C,102C,111C '8.0.1':86C,95C,104C,113C 'admin':8A,48B,125C 'allow':120C 'applianc':67B 'attack':123C 'auth':24B 'auth-requir':23B 'authent':47B,122C 'cloud':20A,22A,43B,92C,97C,110C,115C 'code':61B,130C 'command':10A,63B,132C 'craft':134C 'cve':11A,14A 'directori':52B,77C 'escap':49B 'execut':64B,128C 'flaw':36B 'fortianalyz':2A,26B,39B,83C,87C,91C,96C 'fortianalyzer':18A,21A 'fortimanag':4A,27B,40B,101C,105C,109C,114C 'fortimanager':17A,19A 'fortinet':1A,28B,38B,82C 'host':32B 'improp':69C 'infrastructur':29B 'lead':58B 'let':7A,45B 'limit':70C 'may':119C 'path':5A,34B,78C 'pathnam':73C 'privileg':126C 'request':135C 'requir':25B 'restrict':51B,76C 'run':9A 'say':55B 'self':31B 'self-host':30B 'sourc':54B 'travers':6A,35B,79C 'unauthor':60B,129C 'version':44B 'via':133C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted FortiManager or FortiAnalyzer 7.6.3-7.6.7 or 8.0.0-8.0.1, and the Cloud variants on the same versions. An attacker needs admin privileges, then can send crafted API requests to run code or commands on the appliance. Teams on 7.4 or 7.2 can skip it. Risk is lower when admin access is tightly limited.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:41:06Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-237","run_id":3637},"products":{"at":"2026-11-11T22:41:06Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-237","run_id":3637},"who_affected":{"at":"2026-11-11T22:41:06Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-237","run_id":3637}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["authrequired","fortianalyzer","fortimanager","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126222':13A,16A '-2026':12A,15A 'admin':8A 'cloud':20A,22A 'command':10A 'cve':11A,14A 'fortianalyz':2A 'fortianalyzer':18A,21A 'fortimanag':4A 'fortimanager':17A,19A 'fortinet':1A 'let':7A 'path':5A 'run':9A 'travers':6A","search_b":"'admin':48B 'applianc':67B 'auth':24B 'auth-requir':23B 'authent':47B 'cloud':43B 'code':61B 'command':63B 'directori':52B 'escap':49B 'execut':64B 'flaw':36B 'fortianalyz':26B,39B 'fortimanag':27B,40B 'fortinet':28B,38B 'host':32B 'infrastructur':29B 'lead':58B 'let':45B 'path':34B 'requir':25B 'restrict':51B 'say':55B 'self':31B 'self-host':30B 'sourc':54B 'travers':35B 'unauthor':60B 'version':44B","search_c":"'7.6.3':88C,98C,106C,116C '7.6.7':90C,100C,108C,118C '8.0.0':84C,93C,102C,111C '8.0.1':86C,95C,104C,113C 'admin':125C 'allow':120C 'attack':123C 'authent':122C 'cloud':92C,97C,110C,115C 'code':130C 'command':132C 'craft':134C 'directori':77C 'execut':128C 'fortianalyz':83C,87C,91C,96C 'fortimanag':101C,105C,109C,114C 'fortinet':82C 'improp':69C 'limit':70C 'may':119C 'path':78C 'pathnam':73C 'privileg':126C 'request':135C 'restrict':76C 'travers':79C 'unauthor':129C 'via':133C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126222","severity":null,"published_at":"2026-11-11T22:17:20+00:00","modified_at":"2026-11-11T22:17:20+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126222:3637","url":"https://www.fortiguard.com/psirt/FG-IR-26-237","severity":null,"published_at":"2026-11-11T22:41:06+00:00","modified_at":"2026-11-11T22:41:06+00:00","first_seen_at":"2026-11-11T22:41:06+00:00","fetched_at":"2026-11-11T22:41:06+00:00","note":"Read Fortinet PSIRT FG-IR-26-237: affected/fixed versions, no workaround listed, not known exploited, no PoC seen. Did not search social (not needed for B).","cites":["https://www.fortiguard.com/psirt/FG-IR-26-237"]}],"documents":[{"id":129689,"url":"https://www.fortiguard.com/psirt/FG-IR-26-237","title":"Fortinet PSIRT FG-IR-26-237: Improper limitation of a pathname to a restricted directory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}