---
id: "CVE-2026-126227"
page: "https://infrastack.ai/live/CVE-2026-126227"
kind: "vulnerability"
aliases: ["CVE-2026-126227"]
title: "Fortinet FortiAnalyzer and FortiManager: authenticated users can run commands out of scope"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAnalyzer", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0 - 8.0.1, 7.6.0 - 7.6.7, 7.4.0 - 7.4.11, 7.2.0 - 7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.0 - 8.0.1, 7.6.0 - 7.6.7, 7.4.0 - 7.4.11, 7.2.0 - 7.2.12", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.1, 7.6.0 - 7.6.7, 7.4.1 - 7.4.11, 7.2.1 - 7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": "8.0.1, 7.6.0 - 7.6.7, 7.4.1 - 7.4.11, 7.2.1 - 7.2.12", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["json-api-disabled", "unaffected-version"]
published_at: "2026-11-11T22:17:21+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:40:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126227", "first_seen_at": "2026-11-11T22:29:31+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-242", "first_seen_at": "2026-11-11T22:40:55+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-242"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: authenticated users can run commands out of scope

Link for people: https://infrastack.ai/live/CVE-2026-126227 (this .md is for agents)

Fortinet FortiAnalyzer and FortiManager versions in several branches may let a logged-in attacker run commands outside their intended scope using a specially crafted HTTP request. The attacker gets command execution on the management appliance, which can reach the devices it manages.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected 8.0.0 - 8.0.1, 7.6.0 - 7.6.7, 7.4.0 - 7.4.11, 7.2.0 - 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiManager affected 8.0.0 - 8.0.1, 7.6.0 - 7.6.7, 7.4.0 - 7.4.11, 7.2.0 - 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiAnalyzer Cloud affected 8.0.1, 7.6.0 - 7.6.7, 7.4.1 - 7.4.11, 7.2.1 - 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiManager Cloud affected 8.0.1, 7.6.0 - 7.6.7, 7.4.1 - 7.4.11, 7.2.1 - 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13

## How to check

- Get the version (CLI: get system status; or GUI dashboard) and compare with the affected list: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12 (Cloud: 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12).
- Fortinet says exploitation goes through the JSON API, which is disabled by default. Check admin profiles for rpc-permit: show system admin profile (look for set rpc-permit other than none).
- List admin accounts, since the attacker must be authenticated.

## Fix

Upgrade FortiAnalyzer/FortiManager (and Cloud) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or above, per branch.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126227
- 2026-11-11T22:40:55+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-242 — Read Fortinet PSIRT FG-IR-26-242: fixed versions, JSON API condition and workaround confirmed; not exploited per vendor, no PoC found (no social search done).

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-242: Unintended proxy or intermediary in GUI https://fortiguard.fortinet.com/psirt/FG-IR-26-242

## From the sources

A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the intended scope via specially crafted HTTP request

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_