What is the fix for CVE-2026-126232?

Upgrade FortiManager / FortiAnalyzer (and Cloud variants) to 8.0.2, 7.6.8 or 7.4.12 or later. 7.2 has no fix: migrate to a fixed release. FortiSASE-Sovereign 25.x: migrate to a fixed release; 26.2 needs no action.

Post Share

HIGH7.5CVSS · psirt@fortinet.com

NO KNOWN
EXPLOIT

FORTIMANAGER · CVE-2026-126232 · Infrastructure

Fortinet FortiManager and FortiAnalyzer: RADIUS server certificate not properly validated, enabling impersonation by a MITM attacker

Q: Who is not affected by CVE-2026-126232?

Not affected if: no-radius-auth.

FIX → 7.6.8 +1 ✓ verified

FortiAnalyzer and FortiManager do not properly validate the certificate of the RADIUS server they authenticate against. A man-in-the-middle attacker can impersonate that RADIUS server and answer login checks.

first public Nov 11, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

Organizations running FortiAnalyzer or FortiManager (on-premises or cloud) in the listed version ranges that use RADIUS for authentication. The sources do not say which RADIUS configurations are exposed, so the exposure beyond that is unknown.

FortiManager>= 7.4.0, < 7.4.12fixed in 7.4.12
FortiManager>= 7.6.0, < 7.6.8fixed in 7.6.8
FortiAnalyzer>= 7.4.0, < 7.4.12fixed in 7.4.12
FortiAnalyzer>= 7.6.0, < 7.6.8fixed in 7.6.8

Not affected if no-radius-auth

Who cares fortianalyzer, fortimanager, fortinet, fortisase-sovereign, radius, self-hosted

02 · How to check

Check the installed FortiManager/FortiAnalyzer version (GUI dashboard or CLI 'get system status'). Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, all 7.2; Cloud variants 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, all 7.2.
Check whether RADIUS is configured for administrator login (system admin remote-auth-server / RADIUS server entries). The advisory does not say which RADIUS settings are exposed, so treat any RADIUS use on an affected version as exposed.
Also check FortiSASE-Sovereign 25.x, which the advisory lists.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 11, 2026

How it unfolded

2 events · Nov 11, 2026 → Nov 11, 2026

Nov 11, 202622:29 UTCNVD CVE-2026-126232
Nov 11, 202622:39 UTCInfraStack Analyst Fortinet PSIRT FG-IR-26-247 read: fixes 8.0.2/7.6.8/7.4.12, 7.2 migrate, FortiSASE-Sovereign 25.x also affected; not known exploited, no virtual patch, no workaround listed. Products rows cover 7.4/7.6 only; 8.0 and 7.2 ranges in advisory text. Search of X/posts skipped (low profile).moreless

What the sources say, verbatim

708 characters

A improper certificate validation vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a MITM attacker to impersonate the radius server via a rogue RADIUS server.

Sources and references

NVD: CVE-2026-126232Nov 11, 2026
Fortinet FG-IR-26-247: Improper certificate validation in RADIUS protocolAdvisory · fortiguard.fortinet.com

This page as .md · .json · CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next FortiManager threat the day it hits your stack.

Start free

Post Share

HIGH7.5CVSS · psirt@fortinet.com

NO KNOWN
EXPLOIT

FORTIMANAGER · CVE-2026-126232 · Infrastructure

Fortinet FortiManager and FortiAnalyzer: RADIUS server certificate not properly validated, enabling impersonation by a MITM attacker

FIX → 7.6.8 +1 ✓ verified

first public Nov 11, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

FortiManager>= 7.4.0, < 7.4.12fixed in 7.4.12
FortiManager>= 7.6.0, < 7.6.8fixed in 7.6.8
FortiAnalyzer>= 7.4.0, < 7.4.12fixed in 7.4.12
FortiAnalyzer>= 7.6.0, < 7.6.8fixed in 7.6.8

Not affected if no-radius-auth

Who cares fortianalyzer, fortimanager, fortinet, fortisase-sovereign, radius, self-hosted

02 · How to check

Check the installed FortiManager/FortiAnalyzer version (GUI dashboard or CLI 'get system status'). Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, all 7.2; Cloud variants 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, all 7.2.
Check whether RADIUS is configured for administrator login (system admin remote-auth-server / RADIUS server entries). The advisory does not say which RADIUS settings are exposed, so treat any RADIUS use on an affected version as exposed.
Also check FortiSASE-Sovereign 25.x, which the advisory lists.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 11, 2026

How it unfolded

2 events · Nov 11, 2026 → Nov 11, 2026

Nov 11, 202622:29 UTCNVD CVE-2026-126232
Nov 11, 202622:39 UTCInfraStack Analyst Fortinet PSIRT FG-IR-26-247 read: fixes 8.0.2/7.6.8/7.4.12, 7.2 migrate, FortiSASE-Sovereign 25.x also affected; not known exploited, no virtual patch, no workaround listed. Products rows cover 7.4/7.6 only; 8.0 and 7.2 ranges in advisory text. Search of X/posts skipped (low profile).moreless

What the sources say, verbatim

708 characters

Sources and references

NVD: CVE-2026-126232Nov 11, 2026
Fortinet FG-IR-26-247: Improper certificate validation in RADIUS protocolAdvisory · fortiguard.fortinet.com

This page as .md · .json · CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next FortiManager threat the day it hits your stack.

Start free

Fortinet FortiManager and FortiAnalyzer: RADIUS server certificate not properly validated, enabling impersonation by a MITM attacker

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next FortiManager threat the day it hits your stack.

Fortinet FortiManager and FortiAnalyzer: RADIUS server certificate not properly validated, enabling impersonation by a MITM attacker

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next FortiManager threat the day it hits your stack.

03 · The fix