FORTIMANAGER · CVE-2026-126229 · Infrastructure
FIX → 8.0.2 · 7.6.8 +1 ✓ verified
FortiAnalyzer and FortiManager, Fortinet's log and central management appliances, have an authorization bypass through user-controlled keys. An authenticated administrator can reach other VDOMs (virtual domains) through crafted HTTP requests.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
FortiManager and FortiAnalyzer appliances, including the Cloud editions, on the listed versions. The attacker needs a valid administrator account, so the risk is highest where several teams or customers share one console and rely on VDOM separation. Single-VDOM setups with trusted admins, and patched versions, can deprioritise this.
Not affected if auth-required, single-vdom
Who cares fortianalyzer, fortimanager, fortinet, self-hosted
A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.0.2 · 7.6.8 +1
8.0.2 (8.0.x), 7.6.8 (7.6.x) or 7.4.12 (7.4.x) or later. 7.2 and 7.0 have no fixed build on their branch: migrate to a fixed release