{"id":"CVE-2026-126228","kind":"vulnerability","aliases":["CVE-2026-126228"],"related":[],"title":"Fortinet FortiManager and FortiAnalyzer: out-of-bounds write in dmworker lets an admin run code","description":"A out-of-bounds write vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.4 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.4 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.4 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.4 through 7.2.12 may allow an authenticated remote attacker with admin privileges to execute unauthorized code or commands via a specially crafted request.","summary":"A memory-corruption flaw (out-of-bounds write) in Fortinet FortiAnalyzer and FortiManager management appliances and their cloud versions. An attacker with admin privileges can send a crafted request to execute unauthorized code or commands.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; >= 7.2.4, <= 7.2.12","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; >= 7.2.4, <= 7.2.12","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11; >= 7.2.4, <= 7.2.12","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["8.0.2","7.6.8","7.4.12","7.2.13"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11; >= 7.2.4, <= 7.2.12","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["no-admin-exposure","versions-outside-ranges"],"how_to_check":"Run 'get system status' (or check the GUI dashboard) on each FortiManager/FortiAnalyzer. Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.4-7.2.12. Cloud variants: 7.4.1-7.4.11 on the 7.4 branch, otherwise the same ranges. Fortinet lists no virtual patch.","fix":"Upgrade to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 (or above) on the matching branch, for FortiManager, FortiAnalyzer and their Cloud variants.","status":"open","published_at":"2026-11-11T22:17:21+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:33:25+00:00","updated_at":"2026-11-11T22:39:45+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: out-of-bounds write lets admins run code","impact":"high","summary":"A memory-corruption flaw (out-of-bounds write) in Fortinet FortiAnalyzer and FortiManager management appliances and their cloud versions. An attacker with admin privileges can send a crafted request to execute unauthorized code or commands.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the appliance as an authenticated admin","analyst_note":"Confirm the fixed versions and any vendor advisory for CVE-2026-126228 at the Fortinet PSIRT page; the sources give no fix.","how_to_check":"- Check the installed version of FortiAnalyzer or FortiManager in the admin GUI or with `get system status`\n- Compare it against the affected ranges: 8.0.0 to 8.0.1, 7.6.0 to 7.6.7, 7.4.0 to 7.4.11, 7.2.4 to 7.2.12\n- Check whether FortiAnalyzer Cloud or FortiManager Cloud is in use","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-ranges","no-admin-exposure"],"who_is_affected":"Any organization running the affected FortiAnalyzer or FortiManager versions, on-premises or in the cloud variants, in the listed branches. The attacker must already hold an admin account on the device, which limits exposure to whoever can log in as an administrator. Teams on versions outside the listed ranges are not affected by this entry.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000824,"input_tokens":4921,"output_tokens":663,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and any vendor advisory for CVE-2026-126228 at the Fortinet PSIRT page; the sources give no fix.","search":"'-126228':19A,22A '-2026':18A,21A '7.2.12':97C,117C,133C,153C '7.2.4':95C,115C,131C,151C '7.4.0':91C,127C '7.4.1':110C,146C '7.4.11':93C,112C,129C,148C '7.6.0':87C,105C,123C,141C '7.6.7':89C,107C,125C,143C '8.0.0':83C,100C,119C,136C '8.0.1':85C,102C,121C,138C 'admin':14A,60B,161C 'allow':155C 'applianc':52B 'attack':58B,159C 'authent':157C 'bound':8A,44B,77C 'cloud':26A,28A,55B,99C,104C,109C,114C,135C,140C,145C,150C 'code':16A,70B,166C 'command':72B,168C 'corrupt':39B 'craft':65B,172C 'cve':17A,20A 'dmworker':11A 'execut':68B,164C 'flaw':40B 'fortianalyz':4A,29B,48B,82C,86C,90C,94C,98C,103C,108C,113C 'fortianalyzer':24A,27A 'fortimanag':2A,30B,50B,118C,122C,126C,130C,134C,139C,144C,149C 'fortimanager':23A,25A 'fortinet':1A,31B,47B,81C 'host':34B 'let':12A 'manag':51B 'may':154C 'memori':38B 'memory-corrupt':37B 'out-of-bound':5A,41B,74C 'privileg':61B,162C 'remot':158C 'request':66B,173C 'run':15A 'self':33B 'self-host':32B 'send':63B 'special':171C 'unauthor':69B,165C 'vendor':35B 'version':56B 'via':169C 'vulner':79C 'write':9A,45B,78C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiManager or FortiAnalyzer (on-premises or Cloud) in the listed version ranges. The attacker needs an authenticated admin account and sends a crafted request to the API (dmworker component). Teams whose admin interface is not reachable by untrusted users face less risk, but should still patch.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:39:45Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-243","run_id":3633},"products":{"at":"2026-11-11T22:39:45Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-243","run_id":3633},"how_to_check":{"at":"2026-11-11T22:39:45Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-243","run_id":3633},"who_affected":{"at":"2026-11-11T22:39:45Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-243","run_id":3633}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126228':19A,22A '-2026':18A,21A 'admin':14A 'bound':8A 'cloud':26A,28A 'code':16A 'cve':17A,20A 'dmworker':11A 'fortianalyz':4A 'fortianalyzer':24A,27A 'fortimanag':2A 'fortimanager':23A,25A 'fortinet':1A 'let':12A 'out-of-bound':5A 'run':15A 'write':9A","search_b":"'admin':60B 'applianc':52B 'attack':58B 'bound':44B 'cloud':55B 'code':70B 'command':72B 'corrupt':39B 'craft':65B 'execut':68B 'flaw':40B 'fortianalyz':29B,48B 'fortimanag':30B,50B 'fortinet':31B,47B 'host':34B 'manag':51B 'memori':38B 'memory-corrupt':37B 'out-of-bound':41B 'privileg':61B 'request':66B 'self':33B 'self-host':32B 'send':63B 'unauthor':69B 'vendor':35B 'version':56B 'write':45B","search_c":"'7.2.12':97C,117C,133C,153C '7.2.4':95C,115C,131C,151C '7.4.0':91C,127C '7.4.1':110C,146C '7.4.11':93C,112C,129C,148C '7.6.0':87C,105C,123C,141C '7.6.7':89C,107C,125C,143C '8.0.0':83C,100C,119C,136C '8.0.1':85C,102C,121C,138C 'admin':161C 'allow':155C 'attack':159C 'authent':157C 'bound':77C 'cloud':99C,104C,109C,114C,135C,140C,145C,150C 'code':166C 'command':168C 'craft':172C 'execut':164C 'fortianalyz':82C,86C,90C,94C,98C,103C,108C,113C 'fortimanag':118C,122C,126C,130C,134C,139C,144C,149C 'fortinet':81C 'may':154C 'out-of-bound':74C 'privileg':162C 'remot':158C 'request':173C 'special':171C 'unauthor':165C 'via':169C 'vulner':79C 'write':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126228","severity":null,"published_at":"2026-11-11T22:17:21+00:00","modified_at":"2026-11-11T22:17:21+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126228:3633","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-243","severity":null,"published_at":"2026-11-11T22:39:45+00:00","modified_at":"2026-11-11T22:39:45+00:00","first_seen_at":"2026-11-11T22:39:45+00:00","fetched_at":"2026-11-11T22:39:45+00:00","note":"Fortinet PSIRT FG-IR-26-243 (read directly) confirms CVE-2026-126228, fixed versions, CVSS 7.2, not known exploited. Triage's 'no fix' was wrong. Did not search social; low-profile admin-only bug.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-243"]}],"documents":[{"id":129680,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-243","title":"FG-IR-26-243 Out-of-bounds write in dmworker","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}