{"id":"CVE-2026-126226","kind":"vulnerability","aliases":["CVE-2026-126226"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: report schedule name enables command injection","description":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted report schedule name.","summary":"Fortinet FortiAnalyzer and FortiManager, including their Cloud versions, do not properly neutralize special characters in a report schedule name. An authenticated privileged user can craft that name to run unauthorized code or OS commands on the device.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["fortianalyzer","fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":[],"how_to_check":"- Compare the installed version with the affected ranges: FortiAnalyzer `8.0.0`, `7.6.0` through `7.6.7`, `7.4.0` through `7.4.11`, `7.2.0` through `7.2.12`; FortiManager uses the same ranges.\n- Check FortiAnalyzer Cloud and FortiManager Cloud the same way, using the Cloud ranges in the description.","fix":null,"status":"open","published_at":"2026-11-11T22:17:20+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:33:31+00:00","updated_at":"2026-11-11T22:33:31+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-11T22:33:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Fortinet FortiAnalyzer and FortiManager: report schedule name enables command injection","impact":"high","summary":"Fortinet FortiAnalyzer and FortiManager, including their Cloud versions, do not properly neutralize special characters in a report schedule name. An authenticated privileged user can craft that name to run unauthorized code or OS commands on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs unauthorized OS commands on the management appliance.","analyst_note":"","how_to_check":"- Compare the installed version with the affected ranges: FortiAnalyzer `8.0.0`, `7.6.0` through `7.6.7`, `7.4.0` through `7.4.11`, `7.2.0` through `7.2.12`; FortiManager uses the same ranges.\n- Check FortiAnalyzer Cloud and FortiManager Cloud the same way, using the Cloud ranges in the description.","plain_action":"","product_name":"FortiAnalyzer","needs_analyst":false,"not_affected_if":[],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager (on-premises or Cloud) in the affected version ranges are exposed. The attacker must already hold a privileged account, and the flaw is triggered through the report schedule name field. Teams not running these products can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00122,"input_tokens":4867,"output_tokens":1467,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126226':13A,16A '-2026':12A,15A '7.2.0':90C,122C '7.2.1':108C,140C '7.2.12':92C,110C,124C,142C '7.4.0':86C,118C '7.4.1':103C,135C '7.4.11':88C,105C,120C,137C '7.6.0':82C,98C,114C,130C '7.6.7':84C,100C,116C,132C '8.0.0':80C,95C,112C,127C 'allow':144C 'attack':148C 'authent':45B,146C 'charact':38B 'cloud':31B,94C,97C,102C,107C,126C,129C,134C,139C 'code':55B,152C 'command':9A,58B,72C,74C,154C 'craft':49B,156C 'cve':11A,14A 'devic':61B 'element':67C 'enabl':8A 'execut':150C 'fortianalyz':2A,18B,26B,79C,81C,85C,89C,93C,96C,101C,106C 'fortianalyzer':17A 'fortimanag':4A,19B,28B,111C,113C,117C,121C,125C,128C,133C,138C 'fortinet':1A,20B,25B,78C 'host':24B 'improp':63C 'includ':29B 'infrastructur':21B 'inject':10A,75C 'may':143C 'name':7A,43B,51B,159C 'neutral':36B,64C 'os':57B,71C,73C 'privileg':46B,147C 'proper':35B 'report':5A,41B,157C 'run':53B 'schedul':6A,42B,158C 'self':23B 'self-host':22B 'special':37B,66C 'unauthor':54B,151C 'use':68C 'user':47B 'version':32B 'via':155C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiAnalyzer or FortiManager (on-premises or Cloud) in the affected version ranges are exposed. The attacker must already hold a privileged account, and the flaw is triggered through the report schedule name field. Teams not running these products can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fortianalyzer"],"ptokens":["fortianalyzer"],"labels":["fortianalyzer","fortimanager","fortinet","high","infrastructure","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126226':13A,16A '-2026':12A,15A 'command':9A 'cve':11A,14A 'enabl':8A 'fortianalyz':2A 'fortianalyzer':17A 'fortimanag':4A 'fortinet':1A 'inject':10A 'name':7A 'report':5A 'schedul':6A","search_b":"'authent':45B 'charact':38B 'cloud':31B 'code':55B 'command':58B 'craft':49B 'devic':61B 'fortianalyz':18B,26B 'fortimanag':19B,28B 'fortinet':20B,25B 'host':24B 'includ':29B 'infrastructur':21B 'name':43B,51B 'neutral':36B 'os':57B 'privileg':46B 'proper':35B 'report':41B 'run':53B 'schedul':42B 'self':23B 'self-host':22B 'special':37B 'unauthor':54B 'user':47B 'version':32B","search_c":"'7.2.0':90C,122C '7.2.1':108C,140C '7.2.12':92C,110C,124C,142C '7.4.0':86C,118C '7.4.1':103C,135C '7.4.11':88C,105C,120C,137C '7.6.0':82C,98C,114C,130C '7.6.7':84C,100C,116C,132C '8.0.0':80C,95C,112C,127C 'allow':144C 'attack':148C 'authent':146C 'cloud':94C,97C,102C,107C,126C,129C,134C,139C 'code':152C 'command':72C,74C,154C 'craft':156C 'element':67C 'execut':150C 'fortianalyz':79C,81C,85C,89C,93C,96C,101C,106C 'fortimanag':111C,113C,117C,121C,125C,128C,133C,138C 'fortinet':78C 'improp':63C 'inject':75C 'may':143C 'name':159C 'neutral':64C 'os':71C,73C 'privileg':147C 'report':157C 'schedul':158C 'special':66C 'unauthor':151C 'use':68C 'via':155C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126226","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126226","severity":null,"published_at":"2026-11-11T22:17:20+00:00","modified_at":"2026-11-11T22:17:20+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}