---
id: "CVE-2026-126230"
page: "https://infrastack.ai/live/CVE-2026-126230"
kind: "vulnerability"
aliases: ["CVE-2026-126230"]
title: "Fortinet FortiAnalyzer and FortiManager: format string flaw lets admins run code"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAnalyzer", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["fixed-version", "no-admin-access-exposed", "versions-outside-listed-ranges"]
published_at: "2026-11-11T22:17:21+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:40:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126230", "first_seen_at": "2026-11-11T22:29:31+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-245", "first_seen_at": "2026-11-11T22:40:04+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-245"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: format string flaw lets admins run code

Link for people: https://infrastack.ai/live/CVE-2026-126230 (this .md is for agents)

A format string flaw in Fortinet FortiAnalyzer and FortiManager management products can be triggered by crafted requests. An authenticated administrator could execute unauthorized code or commands, or cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected >= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2
- vendor:FortiManager affected >= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2
- vendor:FortiAnalyzer Cloud affected >= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2
- vendor:FortiManager Cloud affected >= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2

## How to check

Check the version in the admin GUI dashboard or run 'get system status' on the CLI. Exposed if FortiAnalyzer/FortiManager (incl. Cloud) is 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11 or 7.2.0-7.2.12 (Cloud 7.4/7.2 start at .1).

## Fix

Upgrade FortiAnalyzer/FortiManager (and Cloud) to 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or above, per branch.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126230
- 2026-11-11T22:40:04+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-245 — Fortinet PSIRT FG-IR-26-245 read: fixed versions per branch, authenticated, not known exploited, no virtual patch. No workaround stated.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-245: Use of externally-controlled format string https://fortiguard.fortinet.com/psirt/FG-IR-26-245

## From the sources

A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_