---
id: "CVE-2026-126232"
page: "https://infrastack.ai/live/CVE-2026-126232"
kind: "vulnerability"
aliases: ["CVE-2026-126232"]
title: "Fortinet FortiManager and FortiAnalyzer: RADIUS server certificate not properly validated, enabling impersonation by a MITM attacker"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiManager", "fixed": ["7.4.12"], "affected": ">= 7.4.0, < 7.4.12", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["7.6.8"], "affected": ">= 7.6.0, < 7.6.8", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["7.4.12"], "affected": ">= 7.4.0, < 7.4.12", "ecosystem": "vendor"}, {"name": "FortiAnalyzer", "fixed": ["7.6.8"], "affected": ">= 7.6.0, < 7.6.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "fortinet", "fortisase-sovereign", "infrastructure", "radius", "self-hosted"]
not_affected_if: ["no-radius-auth"]
published_at: "2026-11-11T22:17:22+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:39:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126232", "first_seen_at": "2026-11-11T22:29:31+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-247", "first_seen_at": "2026-11-11T22:39:47+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-247"]}]
exploit_sources: []
---

# Fortinet FortiManager and FortiAnalyzer: RADIUS server certificate not properly validated, enabling impersonation by a MITM attacker

Link for people: https://infrastack.ai/live/CVE-2026-126232 (this .md is for agents)

FortiAnalyzer and FortiManager do not properly validate the certificate of the RADIUS server they authenticate against. A man-in-the-middle attacker can impersonate that RADIUS server and answer login checks.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 7.4.0, < 7.4.12 fixed 7.4.12
- vendor:FortiManager affected >= 7.6.0, < 7.6.8 fixed 7.6.8
- vendor:FortiAnalyzer affected >= 7.4.0, < 7.4.12 fixed 7.4.12
- vendor:FortiAnalyzer affected >= 7.6.0, < 7.6.8 fixed 7.6.8

## How to check

- Check the installed FortiManager/FortiAnalyzer version (GUI dashboard or CLI 'get system status'). Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, all 7.2; Cloud variants 8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, all 7.2.
- Check whether RADIUS is configured for administrator login (system admin remote-auth-server / RADIUS server entries). The advisory does not say which RADIUS settings are exposed, so treat any RADIUS use on an affected version as exposed.
- Also check FortiSASE-Sovereign 25.x, which the advisory lists.

## Fix

Upgrade FortiManager / FortiAnalyzer (and Cloud variants) to 8.0.2, 7.6.8 or 7.4.12 or later. 7.2 has no fix: migrate to a fixed release. FortiSASE-Sovereign 25.x: migrate to a fixed release; 26.2 needs no action.

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126232
- 2026-11-11T22:39:47+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-247 — Fortinet PSIRT FG-IR-26-247 read: fixes 8.0.2/7.6.8/7.4.12, 7.2 migrate, FortiSASE-Sovereign 25.x also affected; not known exploited, no virtual patch, no workaround listed. Products rows cover 7.4/7.6 only; 8.0 and 7.2 ranges in advisory text. Search of X/posts skipped (low profile).

## Documents

- [advisory] Fortinet FG-IR-26-247: Improper certificate validation in RADIUS protocol https://fortiguard.fortinet.com/psirt/FG-IR-26-247

## From the sources

A improper certificate validation vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a MITM attacker to impersonate the radius server via a rogue RADIUS server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_