{"id":"CVE-2026-126233","kind":"vulnerability","aliases":["CVE-2026-126233"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: authenticated admins can upload arbitrary files","description":"A unrestricted upload of file with dangerous type vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to upload arbitrary files via specially crafted requests.","summary":"FortiAnalyzer and FortiManager, Fortinet's log and central management appliances, accept file uploads of dangerous types without proper restriction. A logged-in administrator can upload arbitrary files with crafted requests.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortianalyzer","fortimanager","infrastructure","self-hosted"],"not_affected_if":["versions-outside-listed-ranges"],"how_to_check":"- Check the running version of FortiAnalyzer, FortiAnalyzer Cloud, FortiManager or FortiManager Cloud against the affected ranges in the description (for example FortiManager `7.6.0` through `7.6.7`)","fix":"- Fixed versions are not stated in the sources; check Fortinet's advisory for the patched release of each affected line","status":"open","published_at":"2026-11-11T22:17:22+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","triaged_at":"2026-11-11T22:33:22+00:00","updated_at":"2026-11-11T22:33:22+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T22:33:22Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed versions are not stated in the sources; check Fortinet's advisory for the patched release of each affected line","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: authenticated admins can upload arbitrary files","impact":"high","summary":"FortiAnalyzer and FortiManager, Fortinet's log and central management appliances, accept file uploads of dangerous types without proper restriction. A logged-in administrator can upload arbitrary files with crafted requests.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortianalyzer","fortimanager","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated admin plants arbitrary files on the appliance","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126233 to confirm fixed versions per release line and whether uploaded files can be executed.","how_to_check":"- Check the running version of FortiAnalyzer, FortiAnalyzer Cloud, FortiManager or FortiManager Cloud against the affected ranges in the description (for example FortiManager `7.6.0` through `7.6.7`)\n- unknown for other checks: the sources do not say which settings or files to inspect","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-listed-ranges"],"who_is_affected":"Organisations running FortiAnalyzer, FortiManager or their Cloud versions in the listed release ranges, where administrators hold accounts on the management interface. The sources do not say whether the flaw is reachable from the internet by default, so exposure depends on how admin access is placed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000807,"input_tokens":4907,"output_tokens":632,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126233':13A,16A '-2026':12A,15A '7.2.0':78C,114C '7.2.1':98C,134C '7.2.12':80C,100C,116C,136C '7.4.0':74C,110C '7.4.1':93C,129C '7.4.11':76C,95C,112C,131C '7.6.0':70C,88C,106C,124C '7.6.7':72C,90C,108C,126C '8.0.0':66C,83C,102C,119C '8.0.1':68C,85C,104C,121C 'accept':33B 'admin':6A 'administr':46B,141C 'allow':138C 'applianc':32B 'arbitrari':9A,49B,144C 'authent':5A,140C 'central':30B 'cloud':82C,87C,92C,97C,118C,123C,128C,133C 'craft':52B,148C 'cve':11A,14A 'danger':37B,60C 'file':10A,34B,50B,58C,145C 'fortianalyz':2A,17B,23B,65C,69C,73C,77C,81C,86C,91C,96C 'fortimanag':4A,18B,25B,101C,105C,109C,113C,117C,122C,127C,132C 'fortinet':1A,26B,64C 'host':22B 'infrastructur':19B 'log':28B,44B 'logged-in':43B 'manag':31B 'may':137C 'proper':40B 'request':53B,149C 'restrict':41B 'self':21B 'self-host':20B 'special':147C 'type':38B,61C 'unrestrict':55C 'upload':8A,35B,48B,56C,143C 'via':146C 'vulner':62C 'without':39B","nicknames":[],"mitigations":[],"who_affected":"Organisations running FortiAnalyzer, FortiManager or their Cloud versions in the listed release ranges, where administrators hold accounts on the management interface. The sources do not say whether the flaw is reachable from the internet by default, so exposure depends on how admin access is placed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fortianalyzer","fortimanager","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126233':13A,16A '-2026':12A,15A 'admin':6A 'arbitrari':9A 'authent':5A 'cve':11A,14A 'file':10A 'fortianalyz':2A 'fortimanag':4A 'fortinet':1A 'upload':8A","search_b":"'accept':33B 'administr':46B 'applianc':32B 'arbitrari':49B 'central':30B 'craft':52B 'danger':37B 'file':34B,50B 'fortianalyz':17B,23B 'fortimanag':18B,25B 'fortinet':26B 'host':22B 'infrastructur':19B 'log':28B,44B 'logged-in':43B 'manag':31B 'proper':40B 'request':53B 'restrict':41B 'self':21B 'self-host':20B 'type':38B 'upload':35B,48B 'without':39B","search_c":"'7.2.0':78C,114C '7.2.1':98C,134C '7.2.12':80C,100C,116C,136C '7.4.0':74C,110C '7.4.1':93C,129C '7.4.11':76C,95C,112C,131C '7.6.0':70C,88C,106C,124C '7.6.7':72C,90C,108C,126C '8.0.0':66C,83C,102C,119C '8.0.1':68C,85C,104C,121C 'administr':141C 'allow':138C 'arbitrari':144C 'authent':140C 'cloud':82C,87C,92C,97C,118C,123C,128C,133C 'craft':148C 'danger':60C 'file':58C,145C 'fortianalyz':65C,69C,73C,77C,81C,86C,91C,96C 'fortimanag':101C,105C,109C,113C,117C,122C,127C,132C 'fortinet':64C 'may':137C 'request':149C 'special':147C 'type':61C 'unrestrict':55C 'upload':56C,143C 'via':146C 'vulner':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126233","severity":null,"published_at":"2026-11-11T22:17:22+00:00","modified_at":"2026-11-11T22:17:22+00:00","first_seen_at":"2026-11-11T22:29:31+00:00","fetched_at":"2026-11-11T22:29:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}