Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-126262: FortiAnalyzer and FortiManager could let remote code run via OFTP
CVE-2026-126262 · published today
Summary
Versions of FortiAnalyzer and FortiManager that handle OFTP traffic may let an attacker send specially crafted packets and run commands on the device without logging in. This could give the attacker control over the system and access to sensitive data. Apply the vendor's security updates or disable the OFTP service until you can patch.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fortinet | fortianalyzer | <= 8.0.1 |
| fortinet | fortimanager | 8.0.0 |
Original advisory text
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer ...
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published11 Nov 2026
Updated11 Nov 2026
First seen11 Nov 2026
Track software like this
Free during beta