FORTIANALYZER · CVE-2026-126227 · Vendor
FIX → 8.0.2 · 7.6.8 +2 ✓ verified
Fortinet FortiAnalyzer and FortiManager versions in several branches may let a logged-in attacker run commands outside their intended scope using a specially crafted HTTP request. The attacker gets command execution on the management appliance, which can reach the devices it manages.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any FortiAnalyzer, FortiManager, FortiAnalyzer Cloud or FortiManager Cloud on the affected versions where an authenticated admin profile has JSON API access (rpc-permit enabled; disabled by default per Fortinet). A logged-in user can send a crafted HTTP request and run commands outside the intended scope. Teams without these appliances, or whose profiles have rpc-permit none, can skip it; the CVSS vector needs high privileges.
Not affected if json-api-disabled, unaffected-version
Who cares fortianalyzer, fortimanager, fortinet, self-hosted
A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the intended scope via specially crafted HTTP request
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.0.2 · 7.6.8 +2
Upgrade FortiAnalyzer/FortiManager (and Cloud) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or above, per branch.