{"id":"CVE-2026-126262","kind":"vulnerability","aliases":["CVE-2026-126262"],"related":[],"title":"Fortinet FortiAnalyzer and FortiManager: SQL injection lets unauthenticated attackers run commands","description":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets.","summary":"FortiAnalyzer and FortiManager have an SQL injection flaw in their OFTP port handling of crafted packets. An unauthenticated attacker with access to that port may execute code or commands on the system.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortianalyzer","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["oftp-port-not-reachable","other-versions"],"how_to_check":"- Check the installed version of FortiAnalyzer or FortiManager against the affected ranges listed in the description.\n- Check whether the OFTP port is reachable from untrusted networks.","fix":"- Move FortiAnalyzer 8.0 to a release after `8.0.1`, FortiAnalyzer 7.6 after `7.6.7`, FortiAnalyzer 7.4 after `7.4.11`, and FortiAnalyzer 7.2 after `7.2.12`.\n- Move FortiManager 8.0 to a release after `8.0.0`, FortiManager 7.6 after `7.6.7`, FortiManager 7.4 after `7.4.11`, and FortiManager 7.2 after `7.2.12`.","status":"open","published_at":"2026-11-11T22:17:26+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:30:57+00:00","updated_at":"2026-11-11T22:30:57+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T22:30:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move FortiAnalyzer 8.0 to a release after `8.0.1`, FortiAnalyzer 7.6 after `7.6.7`, FortiAnalyzer 7.4 after `7.4.11`, and FortiAnalyzer 7.2 after `7.2.12`.\n- Move FortiManager 8.0 to a release after `8.0.0`, FortiManager 7.6 after `7.6.7`, FortiManager 7.4 after `7.4.11`, and FortiManager 7.2 after `7.2.12`.","reach":"network","title":"Fortinet FortiAnalyzer and FortiManager: SQL injection lets unauthenticated attackers run commands","impact":"high","summary":"FortiAnalyzer and FortiManager have an SQL injection flaw in their OFTP port handling of crafted packets. An unauthenticated attacker with access to that port may execute code or commands on the system.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortinet","fortianalyzer","fortimanager","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker runs commands on the appliance","analyst_note":"Confirm the fixed versions and any workaround from the Fortinet PSIRT advisory, and whether OFTP is enabled by default.","how_to_check":"- Check the installed version of FortiAnalyzer or FortiManager against the affected ranges listed in the description.\n- Check whether the OFTP port is reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["oftp-port-not-reachable","other-versions"],"who_is_affected":"Organizations running affected FortiAnalyzer or FortiManager builds where the OFTP port is reachable by an attacker. Systems where the OFTP port is blocked from untrusted networks are less exposed. Sources do not state a fixed release.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00083,"input_tokens":4697,"output_tokens":720,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126262':14A,17A '-2026':13A,16A '7.2.0':86C,100C '7.2.12':88C,102C '7.4.0':82C,96C '7.4.11':84C,98C '7.6.0':78C,92C '7.6.7':80C,94C '8.0.0':74C,90C '8.0.1':76C 'access':45B,110C 'allow':104C 'attack':9A,43B,107C 'code':51B,117C 'command':11A,53B,67C,119C 'craft':39B,124C 'cve':12A,15A 'element':62C 'execut':50B,116C 'flaw':32B 'fortianalyz':2A,18B,25B,73C,77C,81C,85C 'fortimanag':4A,19B,27B,89C,91C,95C,99C 'fortinet':1A,20B,72C 'handl':37B 'host':23B 'improp':58C 'inject':6A,31B,69C 'let':7A 'may':49B,103C 'neutral':59C 'oftp':35B,113C,125C 'packet':40B,126C 'port':36B,48B,114C 'run':10A 'self':22B 'self-host':21B 'special':61C 'sql':5A,30B,66C,68C 'system':56B,122C 'unauthent':8A,42B,106C 'use':63C 'vendor':24B 'via':123C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Organizations running affected FortiAnalyzer or FortiManager builds where the OFTP port is reachable by an attacker. Systems where the OFTP port is blocked from untrusted networks are less exposed. Sources do not state a fixed release.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","fortianalyzer","fortimanager","fortinet","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126262':14A,17A '-2026':13A,16A 'attack':9A 'command':11A 'cve':12A,15A 'fortianalyz':2A 'fortimanag':4A 'fortinet':1A 'inject':6A 'let':7A 'run':10A 'sql':5A 'unauthent':8A","search_b":"'access':45B 'attack':43B 'code':51B 'command':53B 'craft':39B 'execut':50B 'flaw':32B 'fortianalyz':18B,25B 'fortimanag':19B,27B 'fortinet':20B 'handl':37B 'host':23B 'inject':31B 'may':49B 'oftp':35B 'packet':40B 'port':36B,48B 'self':22B 'self-host':21B 'sql':30B 'system':56B 'unauthent':42B 'vendor':24B","search_c":"'7.2.0':86C,100C '7.2.12':88C,102C '7.4.0':82C,96C '7.4.11':84C,98C '7.6.0':78C,92C '7.6.7':80C,94C '8.0.0':74C,90C '8.0.1':76C 'access':110C 'allow':104C 'attack':107C 'code':117C 'command':67C,119C 'craft':124C 'element':62C 'execut':116C 'fortianalyz':73C,77C,81C,85C 'fortimanag':89C,91C,95C,99C 'fortinet':72C 'improp':58C 'inject':69C 'may':103C 'neutral':59C 'oftp':113C,125C 'packet':126C 'port':114C 'special':61C 'sql':66C,68C 'system':122C 'unauthent':106C 'use':63C 'via':123C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126262","severity":null,"published_at":"2026-11-11T22:17:26+00:00","modified_at":"2026-11-11T22:17:26+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}