{"id":"CVE-2026-126232","kind":"vulnerability","aliases":["CVE-2026-126232"],"related":[],"title":"Fortinet FortiManager and FortiAnalyzer: RADIUS server certificate not properly validated, enabling impersonation by a MITM attacker","description":"A improper certificate validation vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a MITM attacker to impersonate the radius server via a rogue RADIUS server.","summary":"FortiAnalyzer and FortiManager do not properly validate the certificate of the RADIUS server they authenticate against. A man-in-the-middle attacker can impersonate that RADIUS server and answer login checks.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["7.4.12"],"affected":">= 7.4.0, < 7.4.12","ecosystem":"vendor"},{"name":"FortiManager","fixed":["7.6.8"],"affected":">= 7.6.0, < 7.6.8","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["7.4.12"],"affected":">= 7.4.0, < 7.4.12","ecosystem":"vendor"},{"name":"FortiAnalyzer","fixed":["7.6.8"],"affected":">= 7.6.0, < 7.6.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","fortisase-sovereign","infrastructure","radius","self-hosted"],"not_affected_if":["no-radius-auth"],"how_to_check":"- Check the installed FortiManager/FortiAnalyzer version (GUI dashboard or CLI 'get system status'). Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, all 7.2; Cloud variants 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, all 7.2.\n- Check whether RADIUS is configured for administrator login (system admin remote-auth-server / RADIUS server entries). The advisory does not say which RADIUS settings are exposed, so treat any RADIUS use on an affected version as exposed.\n- Also check FortiSASE-Sovereign 25.x, which the advisory lists.","fix":"Upgrade FortiManager / FortiAnalyzer (and Cloud variants) to 8.0.2, 7.6.8 or 7.4.12 or later. 7.2 has no fix: migrate to a fixed release. FortiSASE-Sovereign 25.x: migrate to a fixed release; 26.2 needs no action.","status":"open","published_at":"2026-11-11T22:17:22+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:32:03+00:00","updated_at":"2026-11-11T22:39:47+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:32:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: certificate check lets a rogue RADIUS server impersonate","impact":"medium","summary":"FortiAnalyzer and FortiManager do not properly validate the certificate of the RADIUS server they authenticate against. A man-in-the-middle attacker can impersonate that RADIUS server and answer login checks.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortianalyzer","fortimanager","radius","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker impersonates RADIUS server and accepts forged authentication","analyst_note":"Check Fortinet PSIRT advisory for this CVE for fixed versions and RADIUS configuration details; NVD page alone gives only the affected ranges.","how_to_check":"- Check the installed version of FortiAnalyzer or FortiManager against the affected ranges listed in the advisory.\n- Review whether RADIUS authentication is configured for administrator logins.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-radius-auth"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager (on-premises or cloud) in the listed version ranges that use RADIUS for authentication. The sources do not say which RADIUS configurations are exposed, so the exposure beyond that is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000765,"input_tokens":4867,"output_tokens":556,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Fortinet PSIRT advisory for this CVE for fixed versions and RADIUS configuration details; NVD page alone gives only the affected ranges.","search":"'-126232':19A,22A '-2026':18A,21A '7.2':90C,108C,124C,142C '7.4.0':86C,120C '7.4.1':103C,137C '7.4.11':88C,105C,122C,139C '7.6.0':82C,98C,116C,132C '7.6.7':84C,100C,118C,134C '8.0.0':78C,112C '8.0.1':80C,95C,114C,129C 'allow':146C 'answer':67B 'attack':16A,60B,149C 'authent':52B 'certif':7A,46B,72C 'check':69B 'cloud':94C,97C,102C,107C,128C,131C,136C,141C 'cve':17A,20A 'enabl':11A 'fortianalyz':4A,27B,38B,77C,81C,85C,89C,93C,96C,101C,106C 'fortianalyzer':25A,26A 'fortimanag':2A,28B,40B,111C,115C,119C,123C,127C,130C,135C,140C 'fortimanager':23A,24A 'fortinet':1A,29B,76C 'fortisas':31B 'fortisase-sovereign':30B 'host':37B 'imperson':12A,62B,151C 'improp':71C 'infrastructur':33B 'login':68B 'man':56B 'man-in-the-middl':55B 'may':145C 'middl':59B 'mitm':15A,148C 'proper':9A,43B 'radius':5A,34B,49B,64B,153C,158C 'rogu':157C 'self':36B 'self-host':35B 'server':6A,50B,65B,154C,159C 'sovereign':32B 'valid':10A,44B,73C 'version':92C,110C,126C,144C 'via':155C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiAnalyzer or FortiManager (on-premises or cloud) in the listed version ranges that use RADIUS for authentication. The sources do not say which RADIUS configurations are exposed, so the exposure beyond that is unknown.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:39:47Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-247","run_id":3630},"products":{"at":"2026-11-11T22:39:47Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-247","run_id":3630}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortianalyzer","fortimanager"],"ptokens":["fortianalyzer","fortimanager"],"labels":["fortianalyzer","fortimanager","fortinet","fortisasesovereign","high","infrastructure","radius","selfhosted"],"campaign_type":null,"search_a":"'-126232':19A,22A '-2026':18A,21A 'attack':16A 'certif':7A 'cve':17A,20A 'enabl':11A 'fortianalyz':4A 'fortianalyzer':25A,26A 'fortimanag':2A 'fortimanager':23A,24A 'fortinet':1A 'imperson':12A 'mitm':15A 'proper':9A 'radius':5A 'server':6A 'valid':10A","search_b":"'answer':67B 'attack':60B 'authent':52B 'certif':46B 'check':69B 'fortianalyz':27B,38B 'fortimanag':28B,40B 'fortinet':29B 'fortisas':31B 'fortisase-sovereign':30B 'host':37B 'imperson':62B 'infrastructur':33B 'login':68B 'man':56B 'man-in-the-middl':55B 'middl':59B 'proper':43B 'radius':34B,49B,64B 'self':36B 'self-host':35B 'server':50B,65B 'sovereign':32B 'valid':44B","search_c":"'7.2':90C,108C,124C,142C '7.4.0':86C,120C '7.4.1':103C,137C '7.4.11':88C,105C,122C,139C '7.6.0':82C,98C,116C,132C '7.6.7':84C,100C,118C,134C '8.0.0':78C,112C '8.0.1':80C,95C,114C,129C 'allow':146C 'attack':149C 'certif':72C 'cloud':94C,97C,102C,107C,128C,131C,136C,141C 'fortianalyz':77C,81C,85C,89C,93C,96C,101C,106C 'fortimanag':111C,115C,119C,123C,127C,130C,135C,140C 'fortinet':76C 'imperson':151C 'improp':71C 'may':145C 'mitm':148C 'radius':153C,158C 'rogu':157C 'server':154C,159C 'valid':73C 'version':92C,110C,126C,144C 'via':155C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126232","severity":null,"published_at":"2026-11-11T22:17:22+00:00","modified_at":"2026-11-11T22:17:22+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126232:3630","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-247","severity":null,"published_at":"2026-11-11T22:39:47+00:00","modified_at":"2026-11-11T22:39:47+00:00","first_seen_at":"2026-11-11T22:39:47+00:00","fetched_at":"2026-11-11T22:39:47+00:00","note":"Fortinet PSIRT FG-IR-26-247 read: fixes 8.0.2/7.6.8/7.4.12, 7.2 migrate, FortiSASE-Sovereign 25.x also affected; not known exploited, no virtual patch, no workaround listed. Products rows cover 7.4/7.6 only; 8.0 and 7.2 ranges in advisory text. Search of X/posts skipped (low profile).","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-247"]}],"documents":[{"id":129681,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-247","title":"Fortinet FG-IR-26-247: Improper certificate validation in RADIUS protocol","kind":"advisory","source":"analyst","publisher":null,"text":"Fortinet PSIRT FG-IR-26-247, published 2026-11-10. CWE-295 in RADIUS protocol of FortiSASE Sovereign, FortiManager, FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud. Fixed: 8.0.2, 7.6.8, 7.4.12; 7.2 migrate to fixed release. FortiSASE-Sovereign 26.2 remediated before release; 25.x migrate. No virtual patch. Not known exploited. CVSS 7.5.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}