{"id":"CVE-2026-126231","kind":"vulnerability","aliases":["CVE-2026-126231"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: authenticated OS command injection via HTTP","description":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated attacker to execute unauthorized commands via a crafted HTTP request.","summary":"An OS command injection flaw in the system-ha plugin of FortiAnalyzer and FortiManager (including the Cloud variants) lets an authenticated attacker run unauthorized commands through a crafted HTTP request. Fortinet rates it High (CVSS 7.2), says it is not known to be exploited, and found it internally.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["7.4.12","7.6.8","8.0.1"],"affected":">= 7.4.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.1 || 7.2.x","ecosystem":"vendor"},{"name":"FortiManager","fixed":["7.4.12","7.6.8","8.0.1"],"affected":">= 7.4.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.1 || 7.2.x","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["7.4.12","7.6.8"],"affected":">= 7.4.1, < 7.4.12 || >= 7.6.0, < 7.6.8 || 7.2.x","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["7.4.12","7.6.8"],"affected":">= 7.4.1, < 7.4.12 || >= 7.6.0, < 7.6.8 || 7.2.x","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["auth-required","default-config","fortianalyzer-cloud-8.0"],"how_to_check":"Read the version in System Information (or run 'get system status' on the CLI). You are exposed if FortiAnalyzer or FortiManager is 8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.11, or any 7.2. For the Cloud editions: 7.6.0-7.6.7, 7.4.1-7.4.11 or any 7.2 (8.0 is not affected). Fortinet's advisory says the flaw is in the system-ha plugin; it does not say whether HA must be enabled, so treat all appliances in range as exposed.","fix":"Upgrade to 8.0.1 (8.0.x), 7.6.8 (7.6.x) or 7.4.12 (7.4.x) or later. For 7.2, all versions are affected and there is no 7.2 fix: Fortinet says to migrate to a fixed release. FortiAnalyzer Cloud and FortiManager Cloud 8.0 are not affected.","status":"open","published_at":"2026-11-11T22:17:21+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:33:22+00:00","updated_at":"2026-11-11T22:39:47+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T22:33:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: authenticated OS command injection via HTTP","impact":"high","summary":"FortiAnalyzer and FortiManager, Fortinet's network logging and management appliances, contain an OS command injection flaw. An authenticated attacker can send a crafted HTTP request to run unauthorized commands on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker runs unauthorized operating system commands on the appliance","analyst_note":"Fixed versions and the vendor advisory are not in the sources; check the Fortinet PSIRT advisory for CVE-2026-126231 for fixed builds and mitigations.","how_to_check":"- Check the installed version on the FortiAnalyzer or FortiManager (Fortinet admin interface, System Information) against the affected ranges in the description: 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, and all 7.2 builds.\n- Check whether the appliance is FortiAnalyzer Cloud or FortiManager Cloud, which are listed as affected too.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager, on-premises or in the Cloud versions, within the listed version ranges. The attacker needs valid credentials on the appliance; the flaw is reached through crafted HTTP requests, so exposure of the management interface matters. Teams on versions outside the listed ranges can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000811,"input_tokens":4802,"output_tokens":662,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed versions and the vendor advisory are not in the sources; check the Fortinet PSIRT advisory for CVE-2026-126231 for fixed builds and mitigations.","search":"'-126231':13A,16A '-2026':12A,15A '7.2':66B,107C,122C,136C,151C '7.4.0':103C,132C '7.4.1':117C,146C '7.4.11':105C,119C,134C,148C '7.6.0':99C,112C,128C,141C '7.6.7':101C,114C,130C,143C '8.0.0':97C,126C 'allow':155C 'attack':52B,158C 'authent':5A,51B,157C 'cloud':20A,22A,47B,111C,116C,121C,140C,145C,150C 'command':7A,32B,55B,89C,91C,162C 'craft':58B,165C 'cve':11A,14A 'cvss':65B 'element':84C 'execut':160C 'exploit':74B 'flaw':34B 'fortianalyz':2A,23B,42B,96C,98C,102C,106C,110C,115C,120C 'fortianalyzer':17A,19A 'fortimanag':4A,24B,44B,125C,127C,131C,135C,139C,144C,149C 'fortimanager':18A,21A 'fortinet':1A,25B,61B,95C 'found':76B 'ha':39B 'high':64B 'host':29B 'http':10A,59B,166C 'improp':80C 'includ':45B 'infrastructur':26B 'inject':8A,33B,92C 'intern':78B 'known':71B 'let':49B 'may':154C 'neutral':81C 'os':6A,31B,88C,90C 'plugin':40B 'rate':62B 'request':60B,167C 'run':53B 'say':67B 'self':28B 'self-host':27B 'special':83C 'system':38B 'system-ha':37B 'unauthor':54B,161C 'use':85C 'variant':48B 'version':109C,124C,138C,153C 'via':9A,163C 'vulner':93C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiAnalyzer or FortiManager, on-premises or the Cloud editions, in the listed version ranges. The attacker needs a valid login on the appliance and sends a crafted HTTP request, so limiting who can reach the management interface and who holds accounts lowers the risk. Teams on 8.0.1 or later, 7.6.8 or later, or 7.4.12 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:39:47Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-246","run_id":3631},"products":{"at":"2026-11-11T22:39:47Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-246","run_id":3631},"how_to_check":{"at":"2026-11-11T22:39:47Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-246","run_id":3631},"who_affected":{"at":"2026-11-11T22:39:47Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-246","run_id":3631}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126231':13A,16A '-2026':12A,15A 'authent':5A 'cloud':20A,22A 'command':7A 'cve':11A,14A 'fortianalyz':2A 'fortianalyzer':17A,19A 'fortimanag':4A 'fortimanager':18A,21A 'fortinet':1A 'http':10A 'inject':8A 'os':6A 'via':9A","search_b":"'7.2':66B 'attack':52B 'authent':51B 'cloud':47B 'command':32B,55B 'craft':58B 'cvss':65B 'exploit':74B 'flaw':34B 'fortianalyz':23B,42B 'fortimanag':24B,44B 'fortinet':25B,61B 'found':76B 'ha':39B 'high':64B 'host':29B 'http':59B 'includ':45B 'infrastructur':26B 'inject':33B 'intern':78B 'known':71B 'let':49B 'os':31B 'plugin':40B 'rate':62B 'request':60B 'run':53B 'say':67B 'self':28B 'self-host':27B 'system':38B 'system-ha':37B 'unauthor':54B 'variant':48B","search_c":"'7.2':107C,122C,136C,151C '7.4.0':103C,132C '7.4.1':117C,146C '7.4.11':105C,119C,134C,148C '7.6.0':99C,112C,128C,141C '7.6.7':101C,114C,130C,143C '8.0.0':97C,126C 'allow':155C 'attack':158C 'authent':157C 'cloud':111C,116C,121C,140C,145C,150C 'command':89C,91C,162C 'craft':165C 'element':84C 'execut':160C 'fortianalyz':96C,98C,102C,106C,110C,115C,120C 'fortimanag':125C,127C,131C,135C,139C,144C,149C 'fortinet':95C 'http':166C 'improp':80C 'inject':92C 'may':154C 'neutral':81C 'os':88C,90C 'request':167C 'special':83C 'unauthor':161C 'use':85C 'version':109C,124C,138C,153C 'via':163C 'vulner':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126231","severity":null,"published_at":"2026-11-11T22:17:21+00:00","modified_at":"2026-11-11T22:17:21+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126231:3631","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-246","severity":null,"published_at":"2026-11-11T22:39:47+00:00","modified_at":"2026-11-11T22:39:47+00:00","first_seen_at":"2026-11-11T22:39:47+00:00","fetched_at":"2026-11-11T22:39:47+00:00","note":"Read Fortinet PSIRT FG-IR-26-246: fixed builds, affected ranges, system-ha plugin, no virtual patch, not known exploited. No PoC or discussion searched.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-246"]}],"documents":[{"id":129679,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-246","title":"Fortinet PSIRT FG-IR-26-246","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}