{"id":"CVE-2026-126236","kind":"vulnerability","aliases":["CVE-2026-126236"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: authenticated OS command injection via HTTP","description":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests","summary":"Fortinet FortiAnalyzer and FortiManager management appliances contain an OS command injection flaw triggered by specially crafted HTTP requests. An authenticated attacker can execute unauthorized commands on the device.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAnalyzer","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiManager","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1","ecosystem":"vendor"},{"name":"FortiAnalyzer Cloud","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; 8.0.1","ecosystem":"vendor"},{"name":"FortiManager Cloud","fixed":["7.2.13","7.4.12","7.6.8","8.0.2"],"affected":">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; 8.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","fortianalyzer","fortimanager","fortinet","fortisase-sovereign","infrastructure","network-security"],"not_affected_if":["json-api-disabled","no-fortinet-management-appliance","version-outside-range"],"how_to_check":"Get the firmware version of each FortiAnalyzer, FortiManager, FortiAnalyzer Cloud and FortiManager Cloud (CLI: get system status) and compare it with the affected ranges. Then check whether any admin profile has rpc-permit enabled (config system admin profile; show). Fortinet says the flaw is exploitable via the JSON API if enabled, and it is disabled by default.","fix":"Upgrade to 8.0.2 (8.0.x), 7.6.8 (7.6.x), 7.4.12 (7.4.x) or 7.2.13 (7.2.x) or above, for FortiAnalyzer, FortiManager and their Cloud variants. FortiSASE-Sovereign 26.2: remediated before release, no action; 25.x: migrate to a fixed release. Workaround from Fortinet: if the JSON API is enabled on an admin profile, disable it with: config system admin profile / edit <profile name> / set rpc-permit none / end.","status":"open","published_at":"2026-11-11T22:17:22+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:33:17+00:00","updated_at":"2026-11-11T22:38:47+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T22:33:17Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: authenticated OS command injection via HTTP","impact":"high","summary":"Fortinet FortiAnalyzer and FortiManager management appliances contain an OS command injection flaw triggered by specially crafted HTTP requests. An authenticated attacker can execute unauthorized commands on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","network-security"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker runs arbitrary commands on the appliance","analyst_note":"Check the Fortinet PSIRT advisory for the fixed versions and any workaround; the NVD entry gives no fix.","how_to_check":"- Check the running version of FortiAnalyzer or FortiManager (or FortiAnalyzer Cloud / FortiManager Cloud) against the affected ranges in the NVD entry.\n- Check whether the device is reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range","no-fortinet-management-appliance"],"who_is_affected":"Organizations running FortiAnalyzer or FortiManager (on-premises or Cloud) in the listed version ranges. Exposure depends on who holds valid credentials and whether the management interface is reachable from untrusted networks. Teams without these appliances can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000776,"input_tokens":4882,"output_tokens":575,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for the fixed versions and any workaround; the NVD entry gives no fix.","search":"'-126236':13A,16A '-2026':12A,15A '7.2.0':94C,128C '7.2.1':112C,146C '7.2.12':96C,114C,130C,148C '7.4.0':90C,124C '7.4.1':107C,141C '7.4.11':92C,109C,126C,143C '7.6.0':86C,102C,120C,136C '7.6.7':88C,104C,122C,138C '8.0.0':82C,116C '8.0.1':84C,99C,118C,133C 'allow':150C 'applianc':41B 'attack':56B,153C 'auth':24B 'auth-requir':23B 'authent':5A,55B,152C 'cloud':20A,22A,98C,101C,106C,111C,132C,135C,140C,145C 'code':157C 'command':7A,45B,60B,74C,76C,159C 'contain':42B 'craft':51B,162C 'cve':11A,14A 'devic':63B 'element':69C 'execut':58B,155C 'flaw':47B 'fortianalyz':2A,26B,37B,81C,85C,89C,93C,97C,100C,105C,110C 'fortianalyzer':17A,19A 'fortimanag':4A,27B,39B,115C,119C,123C,127C,131C,134C,139C,144C 'fortimanager':18A,21A 'fortinet':1A,28B,36B,80C 'fortisas':30B 'fortisase-sovereign':29B 'http':10A,52B,163C 'improp':65C 'infrastructur':32B 'inject':8A,46B,77C 'manag':40B 'may':149C 'network':34B 'network-secur':33B 'neutral':66C 'os':6A,44B,73C,75C 'request':53B,164C 'requir':25B 'secur':35B 'sovereign':31B 'special':50B,68C,161C 'trigger':48B 'unauthor':59B,156C 'use':70C 'via':9A,160C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiAnalyzer or FortiManager (on-premises or Cloud) at 7.2.0-7.2.12, 7.4.0-7.4.11, 7.6.0-7.6.7 or 8.0.0-8.0.1 (Cloud variants start at 7.2.1, 7.4.1 and 8.0.1) are affected, as is FortiSASE-Sovereign 25.x. An attacker needs valid admin credentials and sends crafted HTTP requests to the GUI/API. Fortinet says the flaw is exploitable via the JSON API if enabled (disabled by default). Teams without these products can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:38:47Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-251","run_id":3627},"products":{"at":"2026-11-11T22:38:47Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-251","run_id":3627},"how_to_check":{"at":"2026-11-11T22:38:47Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-251","run_id":3627},"who_affected":{"at":"2026-11-11T22:38:47Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-251","run_id":3627}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["cloud","fortianalyzer","fortianalyzercloud","fortimanager","fortimanagercloud"],"ptokens":["cloud","fortianalyzer","fortimanager"],"labels":["authrequired","fortianalyzer","fortimanager","fortinet","fortisasesovereign","high","infrastructure","networksecurity"],"campaign_type":null,"search_a":"'-126236':13A,16A '-2026':12A,15A 'authent':5A 'cloud':20A,22A 'command':7A 'cve':11A,14A 'fortianalyz':2A 'fortianalyzer':17A,19A 'fortimanag':4A 'fortimanager':18A,21A 'fortinet':1A 'http':10A 'inject':8A 'os':6A 'via':9A","search_b":"'applianc':41B 'attack':56B 'auth':24B 'auth-requir':23B 'authent':55B 'command':45B,60B 'contain':42B 'craft':51B 'devic':63B 'execut':58B 'flaw':47B 'fortianalyz':26B,37B 'fortimanag':27B,39B 'fortinet':28B,36B 'fortisas':30B 'fortisase-sovereign':29B 'http':52B 'infrastructur':32B 'inject':46B 'manag':40B 'network':34B 'network-secur':33B 'os':44B 'request':53B 'requir':25B 'secur':35B 'sovereign':31B 'special':50B 'trigger':48B 'unauthor':59B","search_c":"'7.2.0':94C,128C '7.2.1':112C,146C '7.2.12':96C,114C,130C,148C '7.4.0':90C,124C '7.4.1':107C,141C '7.4.11':92C,109C,126C,143C '7.6.0':86C,102C,120C,136C '7.6.7':88C,104C,122C,138C '8.0.0':82C,116C '8.0.1':84C,99C,118C,133C 'allow':150C 'attack':153C 'authent':152C 'cloud':98C,101C,106C,111C,132C,135C,140C,145C 'code':157C 'command':74C,76C,159C 'craft':162C 'element':69C 'execut':155C 'fortianalyz':81C,85C,89C,93C,97C,100C,105C,110C 'fortimanag':115C,119C,123C,127C,131C,134C,139C,144C 'fortinet':80C 'http':163C 'improp':65C 'inject':77C 'may':149C 'neutral':66C 'os':73C,75C 'request':164C 'special':68C,161C 'unauthor':156C 'use':70C 'via':160C 'vulner':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126236","severity":null,"published_at":"2026-11-11T22:17:22+00:00","modified_at":"2026-11-11T22:17:22+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126236:3627","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-251","severity":null,"published_at":"2026-11-11T22:38:47+00:00","modified_at":"2026-11-11T22:38:47+00:00","first_seen_at":"2026-11-11T22:38:47+00:00","fetched_at":"2026-11-11T22:38:47+00:00","note":"Read Fortinet FG-IR-26-251: fixed versions and JSON API workaround from vendor page; not exploited per vendor.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-251"]}],"documents":[{"id":129676,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-251","title":"Fortinet FG-IR-26-251","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}