---
id: "CVE-2026-126233"
page: "https://infrastack.ai/live/CVE-2026-126233"
kind: "vulnerability"
aliases: ["CVE-2026-126233"]
title: "Fortinet FortiAnalyzer and FortiManager: authenticated admins can upload arbitrary files"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fortianalyzer", "fortimanager", "infrastructure", "self-hosted"]
not_affected_if: ["versions-outside-listed-ranges"]
published_at: "2026-11-11T22:17:22+00:00"
first_seen_at: "2026-11-11T22:29:31+00:00"
updated_at: "2026-11-11T22:33:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126233", "first_seen_at": "2026-11-11T22:29:31+00:00"}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: authenticated admins can upload arbitrary files

Link for people: https://infrastack.ai/live/CVE-2026-126233 (this .md is for agents)

FortiAnalyzer and FortiManager, Fortinet's log and central management appliances, accept file uploads of dangerous types without proper restriction. A logged-in administrator can upload arbitrary files with crafted requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running version of FortiAnalyzer, FortiAnalyzer Cloud, FortiManager or FortiManager Cloud against the affected ranges in the description (for example FortiManager `7.6.0` through `7.6.7`)

## Fix

- Fixed versions are not stated in the sources; check Fortinet's advisory for the patched release of each affected line

## Timeline

- 2026-11-11T22:29:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126233

## From the sources

A unrestricted upload of file with dangerous type vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to upload arbitrary files via specially crafted requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_