FORTIMANAGER · CVE-2026-126228 · Vendor
FIX → 8.0.2 · 7.6.8 +2 ✓ verified
A memory-corruption flaw (out-of-bounds write) in Fortinet FortiAnalyzer and FortiManager management appliances and their cloud versions. An attacker with admin privileges can send a crafted request to execute unauthorized code or commands.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running FortiManager or FortiAnalyzer (on-premises or Cloud) in the listed version ranges. The attacker needs an authenticated admin account and sends a crafted request to the API (dmworker component). Teams whose admin interface is not reachable by untrusted users face less risk, but should still patch.
Not affected if no-admin-exposure, versions-outside-ranges
Who cares fortianalyzer, fortimanager, fortinet, self-hosted
A out-of-bounds write vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.4 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.4 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.4 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.4 through 7.2.12 may allow an authenticated remote attacker with admin privileges to execute unauthorized code or commands via a specially crafted request.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
get system status (or check the GUI dashboard) on each FortiManager/FortiAnalyzer8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.4-7.2.127.4.1-7.4.11 on the 7.4 branch, otherwise the same rangesUpgrade to 8.0.2 · 7.6.8 +2
Upgrade to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 (or above) on the matching branch, for FortiManager, FortiAnalyzer and their Cloud variants.