Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

FortiAnalyzer/FortiManager let admin view other domains

CVE-2026-126229 · published today
Summary

Versions of FortiAnalyzer, FortiManager and their cloud services let a logged‑in administrator send specially crafted web requests to see data in other virtual domains. This could expose sensitive information across separate parts of your network. Apply the vendor’s security updates or patches as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
fortinet fortimanager <= 8.0.1
fortinet fortianalyzer <= 8.0.1
fortinet fortimanager cloud 8.0.1
fortinet fortianalyzer cloud 8.0.1
Original advisory text
A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer ...
A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published11 Nov 2026
Updated11 Nov 2026
First seen11 Nov 2026
Sources
CVE-2026-126229 · NVD
CVE-2026-126229 · MITRE
Track software like this
Free during beta