{"id":"CVE-2026-126234","kind":"vulnerability","aliases":["CVE-2026-126234"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: template injection lets a restricted user run commands","description":"A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands via a specially crafted request.","summary":"A template engine flaw in Fortinet FortiAnalyzer and FortiManager version 8.0.0 lets a logged-in user with restricted privileges send a crafted request that runs unauthorized code or commands. The sources give a CVSS score of 7.2 and do not say whether the flaw is exploited in the wild.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["8.0.1"],"affected":"8.0.0","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["8.0.1"],"affected":"8.0.0","ecosystem":"vendor"},{"name":"FortiManager","fixed":["8.0.1"],"affected":"8.0.0","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["8.0.1"],"affected":"8.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","fortianalyzer","fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["no-restricted-accounts","patched-8.0.1","version-7.x"],"how_to_check":"Check the firmware version of FortiAnalyzer, FortiManager and their Cloud variants (GUI dashboard or CLI 'get system status'). Only 8.0.0 is affected; 7.2, 7.4 and 7.6 are not.","fix":"Upgrade FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud 8.0.0 to 8.0.1 or above. 7.2, 7.4 and 7.6 are not affected.","status":"open","published_at":"2026-11-11T22:17:22+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:33:21+00:00","updated_at":"2026-11-11T22:38:56+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T22:33:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: template injection lets a restricted user run commands","impact":"high","summary":"A template engine flaw in Fortinet FortiAnalyzer and FortiManager version 8.0.0 lets a logged-in user with restricted privileges send a crafted request that runs unauthorized code or commands. The sources give a CVSS score of 7.2 and do not say whether the flaw is exploited in the wild.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortianalyzer","fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Commands run on the management appliance by a restricted user","analyst_note":"Check the Fortinet PSIRT advisory for the fixed version and any workaround for FortiAnalyzer and FortiManager 8.0.0; the NVD entry gives neither.","how_to_check":"- Check the installed version of FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud; the affected version is `8.0.0`.\n- unknown for further checks: the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-restricted-accounts"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager version 8.0.0, on-premises or in the Cloud variants, where users hold restricted accounts. The attacker must already be authenticated, so exposure depends on who has logins to these management appliances. unknown for whether default configurations are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000766,"input_tokens":4584,"output_tokens":615,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for the fixed version and any workaround for FortiAnalyzer and FortiManager 8.0.0; the NVD entry gives neither.","search":"'-126234':15A,18A '-2026':14A,17A '7.2':72B '8.0.0':45B,100C,103C,105C,108C 'allow':110C 'attack':113C 'auth':26B 'auth-requir':25B 'authent':112C 'cloud':21A,24A,102C,107C 'code':62B,120C 'command':12A,64B,122C 'craft':57B,126C 'cve':13A,16A 'cvss':69B 'element':90C 'engin':37B,95C 'execut':118C 'exploit':81B 'flaw':38B,79B 'fortianalyz':2A,28B,41B,99C,101C 'fortianalyzer':19A,20A 'fortimanag':4A,29B,43B,104C,106C 'fortimanager':22A,23A 'fortinet':1A,30B,40B,98C 'give':67B 'host':34B 'improp':86C 'infrastructur':31B 'inject':6A 'let':7A,46B 'log':49B 'logged-in':48B 'may':109C 'neutral':87C 'privileg':54B,116C 'request':58B,127C 'requir':27B 'restrict':9A,53B,115C 'run':11A,60B 'say':76B 'score':70B 'self':33B 'self-host':32B 'send':55B 'sourc':66B 'special':89C,125C 'templat':5A,36B,94C 'unauthor':61B,119C 'use':91C 'user':10A,51B 'version':44B 'via':123C 'vulner':96C 'whether':77B 'wild':84B","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiAnalyzer or FortiManager (including the Cloud variants) on exactly version 8.0.0. An authenticated user with restricted privileges can send a crafted API request that injects into the template engine and runs code or commands. Anyone on 7.x or 8.0.1 and later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:38:56Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-249","run_id":3629},"products":{"at":"2026-11-11T22:38:56Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-249","run_id":3629},"how_to_check":{"at":"2026-11-11T22:38:56Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-249","run_id":3629},"who_affected":{"at":"2026-11-11T22:38:56Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-249","run_id":3629}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["authrequired","fortianalyzer","fortimanager","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126234':15A,18A '-2026':14A,17A 'cloud':21A,24A 'command':12A 'cve':13A,16A 'fortianalyz':2A 'fortianalyzer':19A,20A 'fortimanag':4A 'fortimanager':22A,23A 'fortinet':1A 'inject':6A 'let':7A 'restrict':9A 'run':11A 'templat':5A 'user':10A","search_b":"'7.2':72B '8.0.0':45B 'auth':26B 'auth-requir':25B 'code':62B 'command':64B 'craft':57B 'cvss':69B 'engin':37B 'exploit':81B 'flaw':38B,79B 'fortianalyz':28B,41B 'fortimanag':29B,43B 'fortinet':30B,40B 'give':67B 'host':34B 'infrastructur':31B 'let':46B 'log':49B 'logged-in':48B 'privileg':54B 'request':58B 'requir':27B 'restrict':53B 'run':60B 'say':76B 'score':70B 'self':33B 'self-host':32B 'send':55B 'sourc':66B 'templat':36B 'unauthor':61B 'user':51B 'version':44B 'whether':77B 'wild':84B","search_c":"'8.0.0':100C,103C,105C,108C 'allow':110C 'attack':113C 'authent':112C 'cloud':102C,107C 'code':120C 'command':122C 'craft':126C 'element':90C 'engin':95C 'execut':118C 'fortianalyz':99C,101C 'fortimanag':104C,106C 'fortinet':98C 'improp':86C 'may':109C 'neutral':87C 'privileg':116C 'request':127C 'restrict':115C 'special':89C,125C 'templat':94C 'unauthor':119C 'use':91C 'via':123C 'vulner':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126234","severity":null,"published_at":"2026-11-11T22:17:22+00:00","modified_at":"2026-11-11T22:17:22+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126234:3629","url":"https://www.fortiguard.com/psirt/FG-IR-26-249","severity":null,"published_at":"2026-11-11T22:38:56+00:00","modified_at":"2026-11-11T22:38:56+00:00","first_seen_at":"2026-11-11T22:38:56+00:00","fetched_at":"2026-11-11T22:38:56+00:00","note":"Read Fortinet FG-IR-26-249: only 8.0.0 affected, fix 8.0.1; no workaround listed, no virtual patch, Known Exploited: No.","cites":["https://www.fortiguard.com/psirt/FG-IR-26-249"]}],"documents":[{"id":129678,"url":"https://www.fortiguard.com/psirt/FG-IR-26-249","title":"Fortinet FG-IR-26-249","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}