{"id":"CVE-2026-126223","kind":"vulnerability","aliases":["CVE-2026-126223"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: buffer overflow lets admins run code","description":"A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests.","summary":"A stack-based buffer overflow in Fortinet FortiAnalyzer and FortiManager, including their cloud editions, is triggered by specially crafted JSON-RPC requests. An authenticated administrator can execute unauthorized code or commands or cause a denial of service.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["7.4.12","7.6.8","8.0.2"],"affected":">= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["7.4.12","7.6.8","8.0.2"],"affected":">= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["7.4.12","7.6.8","8.0.2"],"affected":">= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["7.4.12","7.6.8","8.0.2"],"affected":">= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","fortianalyzer","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["fixed-version","no-admin-access-exposed","non-affected-versions","version-7.2"],"how_to_check":"Check the firmware version in the FortiManager/FortiAnalyzer GUI dashboard or with 'get system status'. Exposed if 7.4.0-7.4.11, 7.6.0-7.6.7 or 8.0.0-8.0.1 (Cloud editions: 7.4.1-7.4.11, 7.6.0-7.6.7, 8.0.0-8.0.1). Also review who holds admin accounts and who can reach the admin/JSON-RPC interface.","fix":"Upgrade FortiManager/FortiAnalyzer (and Cloud editions) to 8.0.2, 7.6.8 or 7.4.12 or above. 7.2 is not affected.","status":"open","published_at":"2026-11-11T22:17:20+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:33:32+00:00","updated_at":"2026-11-11T22:40:59+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:32Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: buffer overflow lets admins run code","impact":"high","summary":"A stack-based buffer overflow in Fortinet FortiAnalyzer and FortiManager, including their cloud editions, is triggered by specially crafted JSON-RPC requests. An authenticated administrator can execute unauthorized code or commands or cause a denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated admin runs unauthorized code or commands on the appliance","analyst_note":"Check the Fortinet PSIRT advisory for this CVE for the fixed versions and workarounds; the NVD entry gives only the affected ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-admin-access-exposed","non-affected-versions"],"who_is_affected":"Organisations running FortiAnalyzer or FortiManager on-premises or in the Fortinet cloud editions on the affected 7.4, 7.6 and 8.0 release ranges are exposed. The attack requires an administrator account, so exposure depends on who holds admin access to these management systems. Teams that do not run these products can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4834,"output_tokens":541,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for this CVE for the fixed versions and workarounds; the NVD entry gives only the affected ranges.","search":"'-126223':13A,16A '-2026':12A,15A '7.4.0':90C,117C '7.4.1':105C,132C '7.4.11':92C,107C,119C,134C '7.6.0':86C,100C,113C,127C '7.6.7':88C,102C,115C,129C '8.0.0':82C,95C,109C,122C '8.0.1':84C,97C,111C,124C 'admin':8A 'administr':59B,139C 'allow':136C 'auth':24B 'auth-requir':23B 'authent':58B,138C 'base':36B,75C 'buffer':5A,37B,76C 'caus':67B,147C 'cloud':20A,22A,46B,94C,99C,104C,121C,126C,131C 'code':10A,63B,143C 'command':65B,145C 'craft':52B,154C 'cve':11A,14A 'denial':69B,149C 'edit':47B 'execut':61B,141C 'fortianalyz':2A,26B,41B,81C,85C,89C,93C,98C,103C 'fortianalyzer':18A,21A 'fortimanag':4A,27B,43B,108C,112C,116C,120C,125C,130C 'fortimanager':17A,19A 'fortinet':1A,28B,40B,80C 'host':31B 'includ':44B 'json':54B,156C 'json-rpc':53B,155C 'let':7A 'may':135C 'overflow':6A,38B,77C 'request':56B,158C 'requir':25B 'rpc':55B,157C 'run':9A 'self':30B 'self-host':29B 'servic':71B,151C 'special':51B,153C 'stack':35B,74C 'stack-bas':34B,73C 'trigger':49B 'unauthor':62B,142C 'vendor':32B 'via':152C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"FortiManager and FortiAnalyzer, on-premises and Cloud editions, on 7.4.0-7.4.11, 7.6.0-7.6.7 or 8.0.0-8.0.1 are affected. Exploitation needs an authenticated administrator sending crafted JSON-RPC requests, so exposure depends on who has admin access and network reach to the management interface. 7.2 and teams not running these products can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:40:59Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-238","run_id":3636},"products":{"at":"2026-11-11T22:40:59Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-238","run_id":3636},"how_to_check":{"at":"2026-11-11T22:40:59Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-238","run_id":3636},"who_affected":{"at":"2026-11-11T22:40:59Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-238","run_id":3636}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["authrequired","fortianalyzer","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126223':13A,16A '-2026':12A,15A 'admin':8A 'buffer':5A 'cloud':20A,22A 'code':10A 'cve':11A,14A 'fortianalyz':2A 'fortianalyzer':18A,21A 'fortimanag':4A 'fortimanager':17A,19A 'fortinet':1A 'let':7A 'overflow':6A 'run':9A","search_b":"'administr':59B 'auth':24B 'auth-requir':23B 'authent':58B 'base':36B 'buffer':37B 'caus':67B 'cloud':46B 'code':63B 'command':65B 'craft':52B 'denial':69B 'edit':47B 'execut':61B 'fortianalyz':26B,41B 'fortimanag':27B,43B 'fortinet':28B,40B 'host':31B 'includ':44B 'json':54B 'json-rpc':53B 'overflow':38B 'request':56B 'requir':25B 'rpc':55B 'self':30B 'self-host':29B 'servic':71B 'special':51B 'stack':35B 'stack-bas':34B 'trigger':49B 'unauthor':62B 'vendor':32B","search_c":"'7.4.0':90C,117C '7.4.1':105C,132C '7.4.11':92C,107C,119C,134C '7.6.0':86C,100C,113C,127C '7.6.7':88C,102C,115C,129C '8.0.0':82C,95C,109C,122C '8.0.1':84C,97C,111C,124C 'administr':139C 'allow':136C 'authent':138C 'base':75C 'buffer':76C 'caus':147C 'cloud':94C,99C,104C,121C,126C,131C 'code':143C 'command':145C 'craft':154C 'denial':149C 'execut':141C 'fortianalyz':81C,85C,89C,93C,98C,103C 'fortimanag':108C,112C,116C,120C,125C,130C 'fortinet':80C 'json':156C 'json-rpc':155C 'may':135C 'overflow':77C 'request':158C 'rpc':157C 'servic':151C 'special':153C 'stack':74C 'stack-bas':73C 'unauthor':142C 'via':152C 'vulner':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126223","severity":null,"published_at":"2026-11-11T22:17:20+00:00","modified_at":"2026-11-11T22:17:20+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126223:3636","url":"https://www.fortiguard.com/psirt/FG-IR-26-238","severity":null,"published_at":"2026-11-11T22:40:59+00:00","modified_at":"2026-11-11T22:40:59+00:00","first_seen_at":"2026-11-11T22:40:59+00:00","fetched_at":"2026-11-11T22:40:59+00:00","note":"Read Fortinet PSIRT FG-IR-26-238: affected ranges, fixed versions, no workaround listed, not known exploited, no virtual patch. 7.2 not affected.","cites":["https://www.fortiguard.com/psirt/FG-IR-26-238"]}],"documents":[{"id":129688,"url":"https://www.fortiguard.com/psirt/FG-IR-26-238","title":"Fortinet PSIRT FG-IR-26-238: Stack-based buffer overflow (CVE-2026-126223)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}