{"id":"CVE-2026-126224","kind":"vulnerability","aliases":["CVE-2026-126224"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: admin argument injection allows unauthorized commands","description":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated privileged admin user to execute unauthorized code or commands.","summary":"Fortinet FortiAnalyzer and FortiManager, and their cloud versions, have an argument injection flaw in a command. An authenticated privileged admin user can use it to execute unauthorized code or commands.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["8.0.1","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12","ecosystem":"vendor"},{"name":"FortiManager","fixed":["8.0.1","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["8.0.1","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["8.0.1","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["auth-required","version-outside-ranges"],"how_to_check":"Check the version (GUI dashboard or CLI 'get system status') on each FortiAnalyzer and FortiManager. Affected: 8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12. FortiAnalyzer Cloud and FortiManager Cloud: 8.0.0; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12. Fortinet's advisory lists no workaround.","fix":"Upgrade FortiAnalyzer/FortiManager (and Cloud) 8.0.0 to 8.0.1. Branches 7.6, 7.4, 7.2: fixed in 7.6.8, 7.4.12, 7.2.13, which Fortinet lists as upcoming (not yet released at publication); until then restrict admin access. Fortinet lists no workaround.","status":"open","published_at":"2026-11-11T22:17:20+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:33:29+00:00","updated_at":"2026-11-11T22:41:03+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: admin argument injection allows unauthorized commands","impact":"high","summary":"Fortinet FortiAnalyzer and FortiManager, and their cloud versions, have an argument injection flaw in a command. An authenticated privileged admin user can use it to execute unauthorized code or commands.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"privileged admin can run unauthorized code or commands","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126224 to get the fixed versions and any workaround; the NVD entry does not state a fix.","how_to_check":"- Check the installed FortiAnalyzer or FortiManager version against the affected ranges in the NVD entry (8.0.0; 7.6.0 through 7.6.7; 7.4.0 through 7.4.11; 7.2.0 through 7.2.12).\n- Cloud deployments: check the FortiAnalyzer Cloud and FortiManager Cloud versions in the same ranges.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","version-outside-ranges"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager, on-premises or in the cloud, on the affected version ranges. The flaw needs an authenticated privileged admin account, so exposure is mainly from admin account misuse or compromise. Teams on versions outside the listed ranges are not in scope.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000803,"input_tokens":4865,"output_tokens":632,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126224 to get the fixed versions and any workaround; the NVD entry does not state a fix.","search":"'-126224':13A,16A '-2026':12A,15A '7.2.0':85C,117C '7.2.1':103C,135C '7.2.12':87C,105C,119C,137C '7.4.0':81C,113C '7.4.1':98C,130C '7.4.11':83C,100C,115C,132C '7.6.0':77C,93C,109C,125C '7.6.7':79C,95C,111C,127C '8.0.0':75C,90C,107C,122C 'admin':5A,49B,143C 'allow':8A,139C 'argument':6A,40B,64C,69C 'authent':47B,141C 'cloud':20A,22A,36B,89C,92C,97C,102C,121C,124C,129C,134C 'code':57B,148C 'command':10A,45B,59B,68C,150C 'cve':11A,14A 'delimit':65C 'execut':55B,146C 'flaw':42B 'fortianalyz':2A,23B,31B,74C,76C,80C,84C,88C,91C,96C,101C 'fortianalyzer':17A,19A 'fortimanag':4A,24B,33B,106C,108C,112C,116C,120C,123C,128C,133C 'fortimanager':18A,21A 'fortinet':1A,25B,30B,73C 'host':28B 'improp':61C 'inject':7A,41B,70C 'may':138C 'neutral':62C 'privileg':48B,142C 'self':27B 'self-host':26B 'unauthor':9A,56B,147C 'use':52B 'user':50B,144C 'vendor':29B 'version':37B 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiAnalyzer or FortiManager (on-premises or the Cloud editions) on the affected versions. Exploitation needs an authenticated privileged admin account, so the risk is a compromised or misused admin login. Fortinet reports no known exploitation. Versions outside the listed ranges can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:41:03Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-239","run_id":3635},"products":{"at":"2026-11-11T22:41:03Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-239","run_id":3635},"how_to_check":{"at":"2026-11-11T22:41:03Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-239","run_id":3635},"who_affected":{"at":"2026-11-11T22:41:03Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-239","run_id":3635}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126224':13A,16A '-2026':12A,15A 'admin':5A 'allow':8A 'argument':6A 'cloud':20A,22A 'command':10A 'cve':11A,14A 'fortianalyz':2A 'fortianalyzer':17A,19A 'fortimanag':4A 'fortimanager':18A,21A 'fortinet':1A 'inject':7A 'unauthor':9A","search_b":"'admin':49B 'argument':40B 'authent':47B 'cloud':36B 'code':57B 'command':45B,59B 'execut':55B 'flaw':42B 'fortianalyz':23B,31B 'fortimanag':24B,33B 'fortinet':25B,30B 'host':28B 'inject':41B 'privileg':48B 'self':27B 'self-host':26B 'unauthor':56B 'use':52B 'user':50B 'vendor':29B 'version':37B","search_c":"'7.2.0':85C,117C '7.2.1':103C,135C '7.2.12':87C,105C,119C,137C '7.4.0':81C,113C '7.4.1':98C,130C '7.4.11':83C,100C,115C,132C '7.6.0':77C,93C,109C,125C '7.6.7':79C,95C,111C,127C '8.0.0':75C,90C,107C,122C 'admin':143C 'allow':139C 'argument':64C,69C 'authent':141C 'cloud':89C,92C,97C,102C,121C,124C,129C,134C 'code':148C 'command':68C,150C 'delimit':65C 'execut':146C 'fortianalyz':74C,76C,80C,84C,88C,91C,96C,101C 'fortimanag':106C,108C,112C,116C,120C,123C,128C,133C 'fortinet':73C 'improp':61C 'inject':70C 'may':138C 'neutral':62C 'privileg':142C 'unauthor':147C 'user':144C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126224","severity":null,"published_at":"2026-11-11T22:17:20+00:00","modified_at":"2026-11-11T22:17:20+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126224:3635","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-239","severity":null,"published_at":"2026-11-11T22:41:03+00:00","modified_at":"2026-11-11T22:41:03+00:00","first_seen_at":"2026-11-11T22:41:03+00:00","fetched_at":"2026-11-11T22:41:03+00:00","note":"Read Fortinet PSIRT FG-IR-26-239 (Nov 10 2026): fixed in 8.0.1 (available); 7.6.8, 7.4.12, 7.2.13 listed as upcoming. No workaround, no virtual patch, not known exploited. Admin-auth required.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-239"]}],"documents":[{"id":129687,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-239","title":"Fortinet PSIRT FG-IR-26-239: Improper neutralization of argument delimiters in a command","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}