---
id: "CVE-2026-126236"
page: "https://infrastack.ai/live/CVE-2026-126236"
kind: "vulnerability"
aliases: ["CVE-2026-126236"]
title: "Fortinet FortiAnalyzer and FortiManager: authenticated OS command injection via HTTP"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiAnalyzer", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1", "ecosystem": "vendor"}, {"name": "FortiAnalyzer Cloud", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; 8.0.1", "ecosystem": "vendor"}, {"name": "FortiManager Cloud", "fixed": ["7.2.13", "7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; 8.0.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "fortianalyzer", "fortimanager", "fortinet", "fortisase-sovereign", "infrastructure", "network-security"]
not_affected_if: ["json-api-disabled", "no-fortinet-management-appliance", "version-outside-range"]
published_at: "2026-11-11T22:17:22+00:00"
first_seen_at: "2026-11-11T22:29:32+00:00"
updated_at: "2026-11-11T22:38:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126236", "first_seen_at": "2026-11-11T22:29:32+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-251", "first_seen_at": "2026-11-11T22:38:47+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-251"]}]
exploit_sources: []
---

# Fortinet FortiAnalyzer and FortiManager: authenticated OS command injection via HTTP

Link for people: https://infrastack.ai/live/CVE-2026-126236 (this .md is for agents)

Fortinet FortiAnalyzer and FortiManager management appliances contain an OS command injection flaw triggered by specially crafted HTTP requests. An authenticated attacker can execute unauthorized commands on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAnalyzer affected >= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2
- vendor:FortiManager affected >= 7.2.0, <= 7.2.12; >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2
- vendor:FortiAnalyzer Cloud affected >= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2
- vendor:FortiManager Cloud affected >= 7.2.1, <= 7.2.12; >= 7.4.1, <= 7.4.11; >= 7.6.0, <= 7.6.7; 8.0.1 fixed 7.2.13, 7.4.12, 7.6.8, 8.0.2

## How to check

Get the firmware version of each FortiAnalyzer, FortiManager, FortiAnalyzer Cloud and FortiManager Cloud (CLI: get system status) and compare it with the affected ranges. Then check whether any admin profile has rpc-permit enabled (config system admin profile; show). Fortinet says the flaw is exploitable via the JSON API if enabled, and it is disabled by default.

## Fix

Upgrade to 8.0.2 (8.0.x), 7.6.8 (7.6.x), 7.4.12 (7.4.x) or 7.2.13 (7.2.x) or above, for FortiAnalyzer, FortiManager and their Cloud variants. FortiSASE-Sovereign 26.2: remediated before release, no action; 25.x: migrate to a fixed release. Workaround from Fortinet: if the JSON API is enabled on an admin profile, disable it with: config system admin profile / edit <profile name> / set rpc-permit none / end.

## Timeline

- 2026-11-11T22:29:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126236
- 2026-11-11T22:38:47+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-251 — Read Fortinet FG-IR-26-251: fixed versions and JSON API workaround from vendor page; not exploited per vendor.

## Documents

- [advisory] Fortinet FG-IR-26-251 https://fortiguard.fortinet.com/psirt/FG-IR-26-251

## From the sources

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_