---
id: "CVE-2026-126231"
page: "https://infrastack.ai/live/CVE-2026-126231"
kind: "vulnerability"
aliases: ["CVE-2026-126231"]
title: "Fortinet FortiAnalyzer and FortiManager: authenticated OS command injection via HTTP"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiAnalyzer", "fixed": ["7.4.12", "7.6.8", "8.0.1"], "affected": ">= 7.4.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.1 || 7.2.x", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["7.4.12", "7.6.8", "8.0.1"], "affected": ">= 7.4.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.1 || 7.2.x", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["7.4.12", "7.6.8"], "affected": ">= 7.4.1, < 7.4.12 || >= 7.6.0, < 7.6.8 || 7.2.x", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["7.4.12", "7.6.8"], "affected": ">= 7.4.1, < 7.4.12 || >= 7.6.0, < 7.6.8 || 7.2.x", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["auth-required", "default-config", "fortianalyzer-cloud-8.0"]
published_at: "2026-11-11T22:17:21+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:39:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126231", "first_seen_at": "2026-11-11T22:29:31+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-246", "first_seen_at": "2026-11-11T22:39:47+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-246"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: authenticated OS command injection via HTTP

Link for people: https://infrastack.ai/live/CVE-2026-126231 (this .md is for agents)

An OS command injection flaw in the system-ha plugin of FortiAnalyzer and FortiManager (including the Cloud variants) lets an authenticated attacker run unauthorized commands through a crafted HTTP request. Fortinet rates it High (CVSS 7.2), says it is not known to be exploited, and found it internally.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected >= 7.4.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.1 || 7.2.x fixed 7.4.12, 7.6.8, 8.0.1
- vendor:FortiManager affected >= 7.4.0, < 7.4.12 || >= 7.6.0, < 7.6.8 || >= 8.0.0, < 8.0.1 || 7.2.x fixed 7.4.12, 7.6.8, 8.0.1
- vendor:FortiAnalyzer Cloud affected >= 7.4.1, < 7.4.12 || >= 7.6.0, < 7.6.8 || 7.2.x fixed 7.4.12, 7.6.8
- vendor:FortiManager Cloud affected >= 7.4.1, < 7.4.12 || >= 7.6.0, < 7.6.8 || 7.2.x fixed 7.4.12, 7.6.8

## How to check

Read the version in System Information (or run 'get system status' on the CLI). You are exposed if FortiAnalyzer or FortiManager is 8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.11, or any 7.2. For the Cloud editions: 7.6.0-7.6.7, 7.4.1-7.4.11 or any 7.2 (8.0 is not affected). Fortinet's advisory says the flaw is in the system-ha plugin; it does not say whether HA must be enabled, so treat all appliances in range as exposed.

## Fix

Upgrade to 8.0.1 (8.0.x), 7.6.8 (7.6.x) or 7.4.12 (7.4.x) or later. For 7.2, all versions are affected and there is no 7.2 fix: Fortinet says to migrate to a fixed release. FortiAnalyzer Cloud and FortiManager Cloud 8.0 are not affected.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126231
- 2026-11-11T22:39:47+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-246 — Read Fortinet PSIRT FG-IR-26-246: fixed builds, affected ranges, system-ha plugin, no virtual patch, not known exploited. No PoC or discussion searched.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-246 https://fortiguard.fortinet.com/psirt/FG-IR-26-246

## From the sources

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated attacker to execute unauthorized commands via a crafted HTTP request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_