---
id: "CVE-2026-126224"
page: "https://infrastack.ai/live/CVE-2026-126224"
kind: "vulnerability"
aliases: ["CVE-2026-126224"]
title: "Fortinet FortiAnalyzer and FortiManager: admin argument injection allows unauthorized commands"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAnalyzer", "fixed": ["8.0.1", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["8.0.1", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["8.0.1", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["8.0.1", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "version-outside-ranges"]
published_at: "2026-11-11T22:17:20+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:41:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126224", "first_seen_at": "2026-11-11T22:29:31+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-239", "first_seen_at": "2026-11-11T22:41:03+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-239"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: admin argument injection allows unauthorized commands

Link for people: https://infrastack.ai/live/CVE-2026-126224 (this .md is for agents)

Fortinet FortiAnalyzer and FortiManager, and their cloud versions, have an argument injection flaw in a command. An authenticated privileged admin user can use it to execute unauthorized code or commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected 8.0.0; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12 fixed 8.0.1, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiManager affected 8.0.0; 7.6.0 - 7.6.7; 7.4.0 - 7.4.11; 7.2.0 - 7.2.12 fixed 8.0.1, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiAnalyzer Cloud affected 8.0.0; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12 fixed 8.0.1, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiManager Cloud affected 8.0.0; 7.6.0 - 7.6.7; 7.4.1 - 7.4.11; 7.2.1 - 7.2.12 fixed 8.0.1, 7.6.8, 7.4.12, 7.2.13

## How to check

Check the version (GUI dashboard or CLI 'get system status') on each FortiAnalyzer and FortiManager. Affected: 8.0.0; 7.6.0-7.6.7; 7.4.0-7.4.11; 7.2.0-7.2.12. FortiAnalyzer Cloud and FortiManager Cloud: 8.0.0; 7.6.0-7.6.7; 7.4.1-7.4.11; 7.2.1-7.2.12. Fortinet's advisory lists no workaround.

## Fix

Upgrade FortiAnalyzer/FortiManager (and Cloud) 8.0.0 to 8.0.1. Branches 7.6, 7.4, 7.2: fixed in 7.6.8, 7.4.12, 7.2.13, which Fortinet lists as upcoming (not yet released at publication); until then restrict admin access. Fortinet lists no workaround.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126224
- 2026-11-11T22:41:03+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-239 — Read Fortinet PSIRT FG-IR-26-239 (Nov 10 2026): fixed in 8.0.1 (available); 7.6.8, 7.4.12, 7.2.13 listed as upcoming. No workaround, no virtual patch, not known exploited. Admin-auth required.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-239: Improper neutralization of argument delimiters in a command https://fortiguard.fortinet.com/psirt/FG-IR-26-239

## From the sources

A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated privileged admin user to execute unauthorized code or commands.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_