---
id: "CVE-2026-126222"
page: "https://infrastack.ai/live/CVE-2026-126222"
kind: "vulnerability"
aliases: ["CVE-2026-126222"]
title: "Fortinet FortiAnalyzer and FortiManager: path traversal lets admins run commands"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiManager", "fixed": ["7.6.8", "8.0.2"], "affected": ">= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["7.6.8", "8.0.2"], "affected": ">= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["7.6.8", "8.0.2"], "affected": ">= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["7.6.8", "8.0.2"], "affected": ">= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "fortianalyzer", "fortimanager", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["auth-required", "no-admin-exposure", "outside-listed-versions", "version-7.4-or-older"]
published_at: "2026-11-11T22:17:20+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:41:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126222", "first_seen_at": "2026-11-11T22:29:31+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-237", "first_seen_at": "2026-11-11T22:41:06+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-237"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: path traversal lets admins run commands

Link for people: https://infrastack.ai/live/CVE-2026-126222 (this .md is for agents)

A path traversal flaw in Fortinet FortiAnalyzer, FortiManager and their cloud versions lets an authenticated admin escape a restricted directory. The sources say this can lead to unauthorized code or command execution on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.6.8, 8.0.2
- vendor:FortiAnalyzer affected >= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.6.8, 8.0.2
- vendor:FortiManager Cloud affected >= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.6.8, 8.0.2
- vendor:FortiAnalyzer Cloud affected >= 7.6.3, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.6.8, 8.0.2

## How to check

Run 'get system status' on the FortiManager/FortiAnalyzer CLI (or check the dashboard) for the firmware version. Exposed if it is 8.0.0-8.0.1 or 7.6.3-7.6.7. 7.4 and 7.2 are not affected. FortiManager Cloud and FortiAnalyzer Cloud are listed on the same ranges. The attacker needs an admin account, so also review who holds admin accounts and API access.

## Fix

FortiManager/FortiAnalyzer (and Cloud) 8.0.x: upgrade to 8.0.2 or above; 7.6.x: upgrade to 7.6.8 or above. 7.4 and 7.2 are not affected.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126222
- 2026-11-11T22:41:06+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-237 — Read Fortinet PSIRT FG-IR-26-237: affected/fixed versions, no workaround listed, not known exploited, no PoC seen. Did not search social (not needed for B).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-237: Improper limitation of a pathname to a restricted directory https://www.fortiguard.com/psirt/FG-IR-26-237

## From the sources

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.3 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.3 through 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.3 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.3 through 7.6.7 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via crafted requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_