{"id":"CVE-2026-126227","kind":"vulnerability","aliases":["CVE-2026-126227"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: authenticated users can run commands out of scope","description":"A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the intended scope via specially crafted HTTP request","summary":"Fortinet FortiAnalyzer and FortiManager versions in several branches may let a logged-in attacker run commands outside their intended scope using a specially crafted HTTP request. The attacker gets command execution on the management appliance, which can reach the devices it manages.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0 - 8.0.1, 7.6.0 - 7.6.7, 7.4.0 - 7.4.11, 7.2.0 - 7.2.12","ecosystem":"vendor"},{"name":"FortiManager","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.0 - 8.0.1, 7.6.0 - 7.6.7, 7.4.0 - 7.4.11, 7.2.0 - 7.2.12","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.1, 7.6.0 - 7.6.7, 7.4.1 - 7.4.11, 7.2.1 - 7.2.12","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":"8.0.1, 7.6.0 - 7.6.7, 7.4.1 - 7.4.11, 7.2.1 - 7.2.12","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["json-api-disabled","unaffected-version"],"how_to_check":"- Get the version (CLI: get system status; or GUI dashboard) and compare with the affected list: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12 (Cloud: 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12).\n- Fortinet says exploitation goes through the JSON API, which is disabled by default. Check admin profiles for rpc-permit: show system admin profile (look for set rpc-permit other than none).\n- List admin accounts, since the attacker must be authenticated.","fix":"Upgrade FortiAnalyzer/FortiManager (and Cloud) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or above, per branch.","status":"open","published_at":"2026-11-11T22:17:21+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:33:26+00:00","updated_at":"2026-11-11T22:40:55+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: authenticated users can run commands out of scope","impact":"high","summary":"Fortinet FortiAnalyzer and FortiManager versions in several branches may let a logged-in attacker run commands outside their intended scope using a specially crafted HTTP request. The attacker gets command execution on the management appliance, which can reach the devices it manages.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"command execution on the management appliance by an authenticated user","analyst_note":"Fixed versions and vendor advisory are not in the sources; check the Fortinet PSIRT advisory for CVE-2026-126227 for fixed versions and mitigations.","how_to_check":"- Check the running version of FortiAnalyzer or FortiManager against the affected ranges in the description: `8.0.0` to `8.0.1`, `7.6.0` to `7.6.7`, `7.4.0` to `7.4.11`, `7.2.0` to `7.2.12`.\n- Check whether FortiAnalyzer Cloud or FortiManager Cloud is in use, since those products are listed too.\n- Check who holds accounts on the appliance, since the attacker must be authenticated.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00079,"input_tokens":4905,"output_tokens":599,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed versions and vendor advisory are not in the sources; check the Fortinet PSIRT advisory for CVE-2026-126227 for fixed versions and mitigations.","search":"'-126227':15A,18A '-2026':14A,17A '7.2.0':98C,132C '7.2.1':116C,150C '7.2.12':100C,118C,134C,152C '7.4.0':94C,128C '7.4.1':111C,145C '7.4.11':96C,113C,130C,147C '7.6.0':90C,106C,124C,140C '7.6.7':92C,108C,126C,142C '8.0.0':86C,120C '8.0.1':88C,103C,122C,137C 'allow':154C 'applianc':67B 'attack':46B,60B,157C 'authent':5A,156C 'branch':39B 'cloud':22A,24A,102C,105C,110C,115C,136C,139C,144C,149C 'command':9A,48B,62B,160C 'confus':80C 'craft':56B,168C 'cve':13A,16A 'deputi':81C 'devic':72B 'execut':63B,159C 'fortianalyz':2A,25B,33B,85C,89C,93C,97C,101C,104C,109C,114C 'fortianalyzer':19A,21A 'fortimanag':4A,26B,35B,119C,123C,127C,131C,135C,138C,143C,148C 'fortimanager':20A,23A 'fortinet':1A,27B,32B,84C 'get':61B 'host':30B 'http':57B,169C 'intend':51B,164C 'intermediari':79C 'let':41B 'log':44B 'logged-in':43B 'manag':66B,74B 'may':40B,153C 'outsid':49B,161C 'proxi':77C 'reach':70B 'request':58B,170C 'run':8A,47B 'scope':12A,52B,165C 'self':29B 'self-host':28B 'sever':38B 'special':55B,167C 'unintend':76C 'use':53B 'user':6A 'vendor':31B 'version':36B 'via':166C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Any FortiAnalyzer, FortiManager, FortiAnalyzer Cloud or FortiManager Cloud on the affected versions where an authenticated admin profile has JSON API access (rpc-permit enabled; disabled by default per Fortinet). A logged-in user can send a crafted HTTP request and run commands outside the intended scope. Teams without these appliances, or whose profiles have rpc-permit none, can skip it; the CVSS vector needs high privileges.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:40:55Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-242","run_id":3634},"products":{"at":"2026-11-11T22:40:55Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-242","run_id":3634},"workarounds":{"at":"2026-11-11T22:40:55Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-242","run_id":3634},"how_to_check":{"at":"2026-11-11T22:40:55Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-242","run_id":3634},"who_affected":{"at":"2026-11-11T22:40:55Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-242","run_id":3634}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126227':15A,18A '-2026':14A,17A 'authent':5A 'cloud':22A,24A 'command':9A 'cve':13A,16A 'fortianalyz':2A 'fortianalyzer':19A,21A 'fortimanag':4A 'fortimanager':20A,23A 'fortinet':1A 'run':8A 'scope':12A 'user':6A","search_b":"'applianc':67B 'attack':46B,60B 'branch':39B 'command':48B,62B 'craft':56B 'devic':72B 'execut':63B 'fortianalyz':25B,33B 'fortimanag':26B,35B 'fortinet':27B,32B 'get':61B 'host':30B 'http':57B 'intend':51B 'let':41B 'log':44B 'logged-in':43B 'manag':66B,74B 'may':40B 'outsid':49B 'reach':70B 'request':58B 'run':47B 'scope':52B 'self':29B 'self-host':28B 'sever':38B 'special':55B 'use':53B 'vendor':31B 'version':36B","search_c":"'7.2.0':98C,132C '7.2.1':116C,150C '7.2.12':100C,118C,134C,152C '7.4.0':94C,128C '7.4.1':111C,145C '7.4.11':96C,113C,130C,147C '7.6.0':90C,106C,124C,140C '7.6.7':92C,108C,126C,142C '8.0.0':86C,120C '8.0.1':88C,103C,122C,137C 'allow':154C 'attack':157C 'authent':156C 'cloud':102C,105C,110C,115C,136C,139C,144C,149C 'command':160C 'confus':80C 'craft':168C 'deputi':81C 'execut':159C 'fortianalyz':85C,89C,93C,97C,101C,104C,109C,114C 'fortimanag':119C,123C,127C,131C,135C,138C,143C,148C 'fortinet':84C 'http':169C 'intend':164C 'intermediari':79C 'may':153C 'outsid':161C 'proxi':77C 'request':170C 'scope':165C 'special':167C 'unintend':76C 'via':166C 'vulner':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126227","severity":null,"published_at":"2026-11-11T22:17:21+00:00","modified_at":"2026-11-11T22:17:21+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126227:3634","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-242","severity":null,"published_at":"2026-11-11T22:40:55+00:00","modified_at":"2026-11-11T22:40:55+00:00","first_seen_at":"2026-11-11T22:40:55+00:00","fetched_at":"2026-11-11T22:40:55+00:00","note":"Read Fortinet PSIRT FG-IR-26-242: fixed versions, JSON API condition and workaround confirmed; not exploited per vendor, no PoC found (no social search done).","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-242"]}],"documents":[{"id":129686,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-242","title":"Fortinet PSIRT FG-IR-26-242: Unintended proxy or intermediary in GUI","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}