---
id: "CVE-2026-126223"
page: "https://infrastack.ai/live/CVE-2026-126223"
kind: "vulnerability"
aliases: ["CVE-2026-126223"]
title: "Fortinet FortiAnalyzer and FortiManager: buffer overflow lets admins run code"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiManager", "fixed": ["7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "fortianalyzer", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["fixed-version", "no-admin-access-exposed", "non-affected-versions", "version-7.2"]
published_at: "2026-11-11T22:17:20+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:40:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126223", "first_seen_at": "2026-11-11T22:29:31+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-238", "first_seen_at": "2026-11-11T22:40:59+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-238"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: buffer overflow lets admins run code

Link for people: https://infrastack.ai/live/CVE-2026-126223 (this .md is for agents)

A stack-based buffer overflow in Fortinet FortiAnalyzer and FortiManager, including their cloud editions, is triggered by specially crafted JSON-RPC requests. An authenticated administrator can execute unauthorized code or commands or cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.4.12, 7.6.8, 8.0.2
- vendor:FortiAnalyzer affected >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.4.12, 7.6.8, 8.0.2
- vendor:FortiManager Cloud affected >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.4.12, 7.6.8, 8.0.2
- vendor:FortiAnalyzer Cloud affected >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.4.12, 7.6.8, 8.0.2

## How to check

Check the firmware version in the FortiManager/FortiAnalyzer GUI dashboard or with 'get system status'. Exposed if 7.4.0-7.4.11, 7.6.0-7.6.7 or 8.0.0-8.0.1 (Cloud editions: 7.4.1-7.4.11, 7.6.0-7.6.7, 8.0.0-8.0.1). Also review who holds admin accounts and who can reach the admin/JSON-RPC interface.

## Fix

Upgrade FortiManager/FortiAnalyzer (and Cloud editions) to 8.0.2, 7.6.8 or 7.4.12 or above. 7.2 is not affected.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126223
- 2026-11-11T22:40:59+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-238 — Read Fortinet PSIRT FG-IR-26-238: affected ranges, fixed versions, no workaround listed, not known exploited, no virtual patch. 7.2 not affected.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-238: Stack-based buffer overflow (CVE-2026-126223) https://www.fortiguard.com/psirt/FG-IR-26-238

## From the sources

A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_