FORTIANALYZER · CVE-2026-126231 · Infrastructure
FIX → 8.0.1 · 7.6.8 +1 ✓ verified
An OS command injection flaw in the system-ha plugin of FortiAnalyzer and FortiManager (including the Cloud variants) lets an authenticated attacker run unauthorized commands through a crafted HTTP request. Fortinet rates it High (CVSS 7.2), says it is not known to be exploited, and found it internally.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running FortiAnalyzer or FortiManager, on-premises or the Cloud editions, in the listed version ranges. The attacker needs a valid login on the appliance and sends a crafted HTTP request, so limiting who can reach the management interface and who holds accounts lowers the risk. Teams on 8.0.1 or later, 7.6.8 or later, or 7.4.12 or later can skip it.
Not affected if auth-required, default-config, fortianalyzer-cloud-8.0
Who cares fortianalyzer, fortimanager, fortinet, self-hosted
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated attacker to execute unauthorized commands via a crafted HTTP request.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
get system status on the CLI)8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.11, or any 7.27.6.0-7.6.7, 7.4.1-7.4.11 or any 7.2 (8.0 is not affected)Upgrade to 8.0.1 · 7.6.8 +1
8.0.1 (8.0.x), 7.6.8 (7.6.x) or 7.4.12 (7.4.x) or later