Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-126170: FortiAnalyzer/FortiManager could run attacker code
CVE-2026-126170 · published today
Summary
Versions of FortiAnalyzer, FortiManager and their cloud services may let an unknown attacker send a crafted web request that executes unauthorized commands on the system. This could let the attacker control the device or steal data. Update to the latest firmware or apply the vendor’s security patch as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fortinet | fortimanager | <= 8.0.2 |
| fortinet | fortianalyzer | <= 8.0.2 |
| fortinet | fortimanager cloud | <= 8.0.2 |
| fortinet | fortianalyzer cloud | <= 8.0.2 |
| fortinet | fortianalyzer-bigdata | <= 7.6.2 |
Original advisory text
A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Clou...
A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-116Improper Encoding or Escaping of Output
Timeline
Published11 Nov 2026
Updated11 Nov 2026
First seen11 Nov 2026
Track software like this
Free during beta