{"id":"CVE-2026-126230","kind":"vulnerability","aliases":["CVE-2026-126230"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: format string flaw lets admins run code","description":"A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted requests.","summary":"A format string flaw in Fortinet FortiAnalyzer and FortiManager management products can be triggered by crafted requests. An authenticated administrator could execute unauthorized code or commands, or cause a denial of service.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiManager","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["fixed-version","no-admin-access-exposed","versions-outside-listed-ranges"],"how_to_check":"Check the version in the admin GUI dashboard or run 'get system status' on the CLI. Exposed if FortiAnalyzer/FortiManager (incl. Cloud) is 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11 or 7.2.0-7.2.12 (Cloud 7.4/7.2 start at .1).","fix":"Upgrade FortiAnalyzer/FortiManager (and Cloud) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or above, per branch.","status":"open","published_at":"2026-11-11T22:17:21+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:33:25+00:00","updated_at":"2026-11-11T22:40:04+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:25Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources list affected ranges but do not state fixed versions","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: format string flaw lets admins run code","impact":"high","summary":"A format string flaw in Fortinet FortiAnalyzer and FortiManager management products can be triggered by crafted requests. An authenticated administrator could execute unauthorized code or commands, or cause a denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Admin attacker runs unauthorized code or commands on the appliance","analyst_note":"Find Fortinet's advisory and the fixed versions for each listed branch at https://nvd.nist.gov/vuln/detail/CVE-2026-126230 and the vendor PSIRT page.","how_to_check":"- Check the installed FortiAnalyzer or FortiManager version in the admin interface against the affected ranges in the NVD entry\n- unknown for other checks: the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-admin-access-exposed","versions-outside-listed-ranges"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager, on-premises or as the cloud versions, in the listed 7.2, 7.4, 7.6 and 8.0 ranges. Exploitation needs an administrator account, so exposure depends on who holds admin access to these management consoles. unknown for whether management interfaces are internet-exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000801,"input_tokens":4908,"output_tokens":620,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Fortinet's advisory and the fixed versions for each listed branch at https://nvd.nist.gov/vuln/detail/CVE-2026-126230 and the vendor PSIRT page.","search":"'-126230':14A,17A '-2026':13A,16A '7.2.0':87C,123C '7.2.1':107C,143C '7.2.12':89C,109C,125C,145C '7.4.0':83C,119C '7.4.1':102C,138C '7.4.11':85C,104C,121C,140C '7.6.0':79C,97C,115C,133C '7.6.7':81C,99C,117C,135C '8.0.0':75C,92C,111C,128C '8.0.1':77C,94C,113C,130C 'admin':9A 'administr':50B,150C 'allow':147C 'authent':49B,149C 'caus':58B,158C 'cloud':21A,23A,91C,96C,101C,106C,127C,132C,137C,142C 'code':11A,54B,154C 'command':56B,156C 'control':68C 'could':51B 'craft':46B,165C 'cve':12A,15A 'denial':60B,160C 'execut':52B,152C 'extern':67C 'externally-control':66C 'flaw':7A,34B 'format':5A,32B,69C 'fortianalyz':2A,24B,37B,74C,78C,82C,86C,90C,95C,100C,105C 'fortianalyzer':18A,20A 'fortimanag':4A,25B,39B,110C,114C,118C,122C,126C,131C,136C,141C 'fortimanager':19A,22A 'fortinet':1A,26B,36B,73C 'host':29B 'let':8A 'manag':40B 'may':146C 'product':41B 'request':47B,166C 'run':10A 'self':28B 'self-host':27B 'servic':62B,162C 'special':164C 'string':6A,33B,70C 'trigger':44B 'unauthor':53B,153C 'use':64C 'vendor':30B 'via':163C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiAnalyzer or FortiManager, including the Cloud variants, in 7.2.0-7.2.12, 7.4.0-7.4.11, 7.6.0-7.6.7 or 8.0.0-8.0.1. Exploitation needs an authenticated administrator sending crafted API requests, so exposure depends on who holds admin access. Versions at or above the fixed builds can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:40:04Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-245","run_id":3632},"products":{"at":"2026-11-11T22:40:04Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-245","run_id":3632},"how_to_check":{"at":"2026-11-11T22:40:04Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-245","run_id":3632},"who_affected":{"at":"2026-11-11T22:40:04Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-245","run_id":3632}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126230':14A,17A '-2026':13A,16A 'admin':9A 'cloud':21A,23A 'code':11A 'cve':12A,15A 'flaw':7A 'format':5A 'fortianalyz':2A 'fortianalyzer':18A,20A 'fortimanag':4A 'fortimanager':19A,22A 'fortinet':1A 'let':8A 'run':10A 'string':6A","search_b":"'administr':50B 'authent':49B 'caus':58B 'code':54B 'command':56B 'could':51B 'craft':46B 'denial':60B 'execut':52B 'flaw':34B 'format':32B 'fortianalyz':24B,37B 'fortimanag':25B,39B 'fortinet':26B,36B 'host':29B 'manag':40B 'product':41B 'request':47B 'self':28B 'self-host':27B 'servic':62B 'string':33B 'trigger':44B 'unauthor':53B 'vendor':30B","search_c":"'7.2.0':87C,123C '7.2.1':107C,143C '7.2.12':89C,109C,125C,145C '7.4.0':83C,119C '7.4.1':102C,138C '7.4.11':85C,104C,121C,140C '7.6.0':79C,97C,115C,133C '7.6.7':81C,99C,117C,135C '8.0.0':75C,92C,111C,128C '8.0.1':77C,94C,113C,130C 'administr':150C 'allow':147C 'authent':149C 'caus':158C 'cloud':91C,96C,101C,106C,127C,132C,137C,142C 'code':154C 'command':156C 'control':68C 'craft':165C 'denial':160C 'execut':152C 'extern':67C 'externally-control':66C 'format':69C 'fortianalyz':74C,78C,82C,86C,90C,95C,100C,105C 'fortimanag':110C,114C,118C,122C,126C,131C,136C,141C 'fortinet':73C 'may':146C 'request':166C 'servic':162C 'special':164C 'string':70C 'unauthor':153C 'use':64C 'via':163C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126230","severity":null,"published_at":"2026-11-11T22:17:21+00:00","modified_at":"2026-11-11T22:17:21+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126230:3632","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-245","severity":null,"published_at":"2026-11-11T22:40:04+00:00","modified_at":"2026-11-11T22:40:04+00:00","first_seen_at":"2026-11-11T22:40:04+00:00","fetched_at":"2026-11-11T22:40:04+00:00","note":"Fortinet PSIRT FG-IR-26-245 read: fixed versions per branch, authenticated, not known exploited, no virtual patch. No workaround stated.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-245"]}],"documents":[{"id":129682,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-245","title":"Fortinet PSIRT FG-IR-26-245: Use of externally-controlled format string","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}