CVE-2026-126170: Fortinet FortiAnalyzer improper encoding of output in JRPC API

CVE-2026-126170 · Severity: critical · CVSS 9.8 · Published 2026-11-11

FortiAnalyzer and FortiManager are centralized logging and security management platforms used to monitor and configure enterprise security devices. An attacker without authentication can exploit improper input encoding in the JSON RPC API to execute arbitrary code or commands on the affected system. This could lead to complete system compromise, data theft, and unauthorized control of managed security infrastructure.

Technologies: Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager, Fortinet FortiManager Cloud, Fortinet FortiSASE-Sovereign. Vendors: Fortinet.

Quick answers

Is CVE-2026-126170 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126170 being exploited in the wild.
How severe is CVE-2026-126170?
Critical severity, with a CVSS score of 9.8, published 11 November 2026.
Which products and versions are affected?
Fortinet Fortianalyzer 8.0.0 through 8.0.2, 7.6.0 through 7.6.7; Fortinet Fortianalyzer Cloud 8.0.1 through 8.0.2, 7.6.0 through 7.6.7; Fortinet FortiAnalyzer-BigData 7.6.0 through 7.6.2; Fortinet FortiManager 8.0.0 through 8.0.2, 7.6.0 through 7.6.7; and 2 more.
Is there a fix for CVE-2026-126170?
Yes: fixed in FortiAnalyzer 8.0.3 or above, 7.6.8 or above; FortiAnalyzer Cloud 8.0.3 or above, 7.6.8 or above; FortiAnalyzer-BigData 7.6.3 or above; FortiManager 8.0.3 or above, 7.6.8 or above; FortiManager Cloud 8.0.3 or above, 7.6.8 or above; FortiSASE-Sovereign 26.2. Until then: The vulnerability only manifests when the JSON API is enabled on an admin profile (disabled by default). Disable it immediately via CLI: config system admin profile, edit the affected profile, and execute "set rpc-permit none". Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126170 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126170?
Check whether you run Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiAnalyzer-BigData or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: FortiAnalyzer 8.0.3 or above, 7.6.8 or above; FortiAnalyzer Cloud 8.0.3 or above, 7.6.8 or above; FortiAnalyzer-BigData 7.6.3 or above; FortiManager 8.0.3 or above, 7.6.8 or above; FortiManager Cloud 8.0.3 or above, 7.6.8 or above; FortiSASE-Sovereign 26.2

The vulnerability only manifests when the JSON API is enabled on an admin profile (disabled by default). Disable it immediately via CLI: config system admin profile, edit the affected profile, and execute "set rpc-permit none".

Technical details

A JSON injection vulnerability (CWE-116) in the JRPC API's output encoding allows unauthenticated network attackers to execute unauthorized code via specially crafted HTTP requests. The vulnerability exists by default only if the JSON API is enabled (disabled by default) within a user profile. An attacker with network access to the GUI port can inject malicious JSON payloads that bypass escaping filters and achieve remote code execution.

Affected products

  • Fortinet FortiAnalyzer 8.0.0 through 8.0.2, 7.6.0 through 7.6.7
  • Fortinet FortiAnalyzer Cloud 8.0.1 through 8.0.2, 7.6.0 through 7.6.7
  • Fortinet FortiAnalyzer-BigData 7.6.0 through 7.6.2
  • Fortinet FortiManager 8.0.0 through 8.0.2, 7.6.0 through 7.6.7
  • Fortinet FortiManager Cloud 8.0.1 through 8.0.2, 7.6.0 through 7.6.7
  • Fortinet FortiSASE-Sovereign 25.0 all versions, 25.3 all versions, 25.4 all versions

Timeline

  • 2026-11-10: disclosed: Fortinet published FG-IR-26-219 advisory
  • 2026-11-11: advisory: NVD published CVE-2026-126170

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.