{"id":"CVE-2026-126229","kind":"vulnerability","aliases":["CVE-2026-126229"],"related":[],"title":"Fortinet FortiManager and FortiAnalyzer: a logged-in admin can reach other VDOMs","description":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests.","summary":"FortiAnalyzer and FortiManager, Fortinet's log and central management appliances, have an authorization bypass through user-controlled keys. An authenticated administrator can reach other VDOMs (virtual domains) through crafted HTTP requests.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["7.4.12","7.6.8","8.0.2"],"affected":">= 7.0.0, < 7.4.12 || >= 7.4.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.2","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["7.4.12","7.6.8","8.0.2"],"affected":">= 7.0.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["auth-required","single-vdom"],"how_to_check":"- On the appliance run 'get system status' (or check System Settings > Dashboard) and compare the firmware: affected are 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, and all 7.2 and 7.0. Cloud editions: 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2, 7.0.\n- If VDOMs are in use (ADOMs/VDOM separation between teams or customers), list which admin accounts exist; any admin account can be abused to cross VDOM boundaries.","fix":"Upgrade to 8.0.2 (8.0.x), 7.6.8 (7.6.x) or 7.4.12 (7.4.x) or later. 7.2 and 7.0 have no fixed build on their branch: migrate to a fixed release. Fortinet lists no workaround and no virtual patch.","status":"open","published_at":"2026-11-11T22:17:21+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:31:06+00:00","updated_at":"2026-11-11T22:32:14+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:31:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: admin can reach other VDOMs","impact":"medium","summary":"FortiAnalyzer and FortiManager, Fortinet's log and central management appliances, have an authorization bypass through user-controlled keys. An authenticated administrator can reach other VDOMs (virtual domains) through crafted HTTP requests.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated admin crosses into other VDOMs' management data","analyst_note":"Check Fortinet's PSIRT advisory for the fixed versions and any workaround; the sources here give only the affected ranges.","how_to_check":"- Check the running firmware version on the FortiAnalyzer or FortiManager appliance against the affected ranges listed in the sources.\n- Review which administrators hold accounts with access to more than one VDOM.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","single-vdom"],"who_is_affected":"Only FortiAnalyzer and FortiManager deployments (including Cloud variants) in the listed version ranges are in scope. The attacker needs an administrator account, so exposure depends on who holds admin credentials and how many VDOMs the appliance hosts. Teams running single-VDOM setups or patched versions can deprioritise this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000776,"input_tokens":4867,"output_tokens":579,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check Fortinet's PSIRT advisory for the fixed versions and any workaround; the sources here give only the affected ranges.","search":"'-126229':16A,19A '-2026':15A,18A '7.2':85C,103C,119C,137C '7.4.0':81C,115C '7.4.1':98C,132C '7.4.11':83C,100C,117C,134C '7.6.0':77C,93C,111C,127C '7.6.7':79C,95C,113C,129C '8.0.0':73C,107C '8.0.1':75C,90C,109C,124C 'access':146C 'admin':9A 'administr':50B,144C 'allow':141C 'applianc':38B 'authent':49B,143C 'author':41B,62C 'bypass':42B,63C 'central':36B 'cloud':89C,92C,97C,102C,123C,126C,131C,136C 'control':46B,67C 'craft':58B,152C 'cve':14A,17A 'domain':56B 'fortianalyz':4A,22B,29B,72C,76C,80C,84C,88C,91C,96C,101C 'fortianalyzer':21A 'fortimanag':2A,23B,31B,106C,110C,114C,118C,122C,125C,130C,135C 'fortimanager':20A 'fortinet':1A,24B,32B,71C 'host':28B 'http':59B,153C 'infrastructur':25B 'key':47B,68C 'log':7A,34B 'logged-in':6A 'manag':37B 'may':140C 'reach':11A,52B 'request':60B,154C 'self':27B 'self-host':26B 'special':151C 'user':45B,66C 'user-control':44B,65C 'vdom':13A,54B,149C 'version':87C,105C,121C,139C 'via':150C 'virtual':55B 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"FortiManager and FortiAnalyzer appliances, including the Cloud editions, on the listed versions. The attacker needs a valid administrator account, so the risk is highest where several teams or customers share one console and rely on VDOM separation. Single-VDOM setups with trusted admins, and patched versions, can deprioritise this.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:32:14Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-244","run_id":3604}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortianalyzer","fortimanager"],"ptokens":["fortianalyzer","fortimanager"],"labels":["critical","fortianalyzer","fortimanager","fortinet","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126229':16A,19A '-2026':15A,18A 'admin':9A 'cve':14A,17A 'fortianalyz':4A 'fortianalyzer':21A 'fortimanag':2A 'fortimanager':20A 'fortinet':1A 'log':7A 'logged-in':6A 'reach':11A 'vdom':13A","search_b":"'administr':50B 'applianc':38B 'authent':49B 'author':41B 'bypass':42B 'central':36B 'control':46B 'craft':58B 'domain':56B 'fortianalyz':22B,29B 'fortimanag':23B,31B 'fortinet':24B,32B 'host':28B 'http':59B 'infrastructur':25B 'key':47B 'log':34B 'manag':37B 'reach':52B 'request':60B 'self':27B 'self-host':26B 'user':45B 'user-control':44B 'vdom':54B 'virtual':55B","search_c":"'7.2':85C,103C,119C,137C '7.4.0':81C,115C '7.4.1':98C,132C '7.4.11':83C,100C,117C,134C '7.6.0':77C,93C,111C,127C '7.6.7':79C,95C,113C,129C '8.0.0':73C,107C '8.0.1':75C,90C,109C,124C 'access':146C 'administr':144C 'allow':141C 'authent':143C 'author':62C 'bypass':63C 'cloud':89C,92C,97C,102C,123C,126C,131C,136C 'control':67C 'craft':152C 'fortianalyz':72C,76C,80C,84C,88C,91C,96C,101C 'fortimanag':106C,110C,114C,118C,122C,125C,130C,135C 'fortinet':71C 'http':153C 'key':68C 'may':140C 'request':154C 'special':151C 'user':66C 'user-control':65C 'vdom':149C 'version':87C,105C,121C,139C 'via':150C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126229","severity":null,"published_at":"2026-11-11T22:17:21+00:00","modified_at":"2026-11-11T22:17:21+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126229:3604","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-244","severity":null,"published_at":"2026-11-11T22:32:14+00:00","modified_at":"2026-11-11T22:32:14+00:00","first_seen_at":"2026-11-11T22:32:14+00:00","fetched_at":"2026-11-11T22:32:14+00:00","note":"Read Fortinet PSIRT FG-IR-26-244: fixes 8.0.2/7.6.8/7.4.12; 7.2 and 7.0 have no fix (migrate); no workaround, no virtual patch, not exploited. Note vendor also lists 7.0 as affected (NVD omits). No X/community check done.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-244"]}],"documents":[{"id":129637,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-244","title":"FG-IR-26-244: Authorization bypass through user-controlled key in dmserver","kind":"advisory","source":"analyst","publisher":null,"text":"Fortinet PSIRT FG-IR-26-244, published 2026-11-10. CWE-639 in FortiManager, FortiAnalyzer and Cloud variants; authenticated admin can access other VDOMs via crafted HTTP requests. Fixed: 8.0.2, 7.6.8, 7.4.12; 7.2 and 7.0 migrate to a fixed release. Known exploited: No. Virtual patch: No. CVSS 9.1.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}