---
id: "CVE-2026-126229"
page: "https://infrastack.ai/live/CVE-2026-126229"
kind: "vulnerability"
aliases: ["CVE-2026-126229"]
title: "Fortinet FortiManager and FortiAnalyzer: a logged-in admin can reach other VDOMs"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiManager", "fixed": ["7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.0.0, < 7.4.12 || >= 7.4.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.2", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.0.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["auth-required", "single-vdom"]
published_at: "2026-11-11T22:17:21+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:32:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126229", "first_seen_at": "2026-11-11T22:29:31+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-244", "first_seen_at": "2026-11-11T22:32:14+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-244"]}]
exploit_sources: []
---

# Fortinet FortiManager and FortiAnalyzer: a logged-in admin can reach other VDOMs

Link for people: https://infrastack.ai/live/CVE-2026-126229 (this .md is for agents)

FortiAnalyzer and FortiManager, Fortinet's log and central management appliances, have an authorization bypass through user-controlled keys. An authenticated administrator can reach other VDOMs (virtual domains) through crafted HTTP requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 7.0.0, < 7.4.12 || >= 7.4.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.2 fixed 7.4.12, 7.6.8, 8.0.2
- vendor:FortiAnalyzer affected >= 7.0.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.2 fixed 7.4.12, 7.6.8, 8.0.2

## How to check

- On the appliance run 'get system status' (or check System Settings > Dashboard) and compare the firmware: affected are 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, and all 7.2 and 7.0. Cloud editions: 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2, 7.0.
- If VDOMs are in use (ADOMs/VDOM separation between teams or customers), list which admin accounts exist; any admin account can be abused to cross VDOM boundaries.

## Fix

Upgrade to 8.0.2 (8.0.x), 7.6.8 (7.6.x) or 7.4.12 (7.4.x) or later. 7.2 and 7.0 have no fixed build on their branch: migrate to a fixed release. Fortinet lists no workaround and no virtual patch.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126229
- 2026-11-11T22:32:14+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-244 — Read Fortinet PSIRT FG-IR-26-244: fixes 8.0.2/7.6.8/7.4.12; 7.2 and 7.0 have no fix (migrate); no workaround, no virtual patch, not exploited. Note vendor also lists 7.0 as affected (NVD omits). No X/community check done.

## Documents

- [advisory] FG-IR-26-244: Authorization bypass through user-controlled key in dmserver https://fortiguard.fortinet.com/psirt/FG-IR-26-244

## From the sources

A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_