---
id: "CVE-2026-126228"
page: "https://infrastack.ai/live/CVE-2026-126228"
kind: "vulnerability"
aliases: ["CVE-2026-126228"]
title: "Fortinet FortiManager and FortiAnalyzer: out-of-bounds write in dmworker lets an admin run code"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiManager", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; >= 7.2.4, <= 7.2.12", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; >= 7.2.4, <= 7.2.12", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11; >= 7.2.4, <= 7.2.12", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["8.0.2", "7.6.8", "7.4.12", "7.2.13"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11; >= 7.2.4, <= 7.2.12", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["no-admin-exposure", "versions-outside-ranges"]
published_at: "2026-11-11T22:17:21+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:39:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126228", "first_seen_at": "2026-11-11T22:29:31+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-243", "first_seen_at": "2026-11-11T22:39:45+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-243"]}]
exploit_sources: []
---

# Fortinet FortiManager and FortiAnalyzer: out-of-bounds write in dmworker lets an admin run code

Link for people: https://infrastack.ai/live/CVE-2026-126228 (this .md is for agents)

A memory-corruption flaw (out-of-bounds write) in Fortinet FortiAnalyzer and FortiManager management appliances and their cloud versions. An attacker with admin privileges can send a crafted request to execute unauthorized code or commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; >= 7.2.4, <= 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiAnalyzer affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; >= 7.2.4, <= 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiManager Cloud affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11; >= 7.2.4, <= 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13
- vendor:FortiAnalyzer Cloud affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.1, <= 7.4.11; >= 7.2.4, <= 7.2.12 fixed 8.0.2, 7.6.8, 7.4.12, 7.2.13

## How to check

Run 'get system status' (or check the GUI dashboard) on each FortiManager/FortiAnalyzer. Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.4-7.2.12. Cloud variants: 7.4.1-7.4.11 on the 7.4 branch, otherwise the same ranges. Fortinet lists no virtual patch.

## Fix

Upgrade to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 (or above) on the matching branch, for FortiManager, FortiAnalyzer and their Cloud variants.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126228
- 2026-11-11T22:39:45+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-243 — Fortinet PSIRT FG-IR-26-243 (read directly) confirms CVE-2026-126228, fixed versions, CVSS 7.2, not known exploited. Triage's 'no fix' was wrong. Did not search social; low-profile admin-only bug.

## Documents

- [advisory] FG-IR-26-243 Out-of-bounds write in dmworker https://fortiguard.fortinet.com/psirt/FG-IR-26-243

## From the sources

A out-of-bounds write vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.4 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.4 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.4 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.4 through 7.2.12 may allow an authenticated remote attacker with admin privileges to execute unauthorized code or commands via a specially crafted request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_