CVE-2026-126227: Fortinet FortiAnalyzer and FortiManager confused deputy in GUI

CVE-2026-126227 · Severity: high · CVSS 7.2 · Published 2026-11-11

FortiAnalyzer and FortiManager are centralized management and log analysis platforms for Fortinet security appliances. An authenticated attacker can craft special HTTP requests to execute commands beyond their intended scope, potentially allowing privilege escalation or unauthorized actions within the management console. The vulnerability affects both on-premises and cloud versions of both products.

Technologies: Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager, Fortinet FortiManager Cloud. Vendors: Fortinet.

Quick answers

Is CVE-2026-126227 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126227 being exploited in the wild.
How severe is CVE-2026-126227?
High severity, with a CVSS score of 7.2, published 11 November 2026.
Which products and versions are affected?
Fortinet Fortianalyzer 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12; Fortinet Fortianalyzer Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12; Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12; Fortinet FortiManager Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12.
Is there a fix for CVE-2026-126227?
Yes: fixed in FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiAnalyzer Cloud 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiManager 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiManager Cloud 8.0.2, 7.6.8, 7.4.12, 7.2.13. Until then: If JSON API is enabled, disable it or restrict it via the configuration: set the admin profile's rpc-permit to 'none' to reduce attack surface. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126227 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126227?
Check whether you run Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiAnalyzer Cloud 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiManager 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiManager Cloud 8.0.2, 7.6.8, 7.4.12, 7.2.13

If JSON API is enabled, disable it or restrict it via the configuration: set the admin profile's rpc-permit to 'none' to reduce attack surface.

Technical details

A confused deputy vulnerability (CWE-441) in the GUI and JSON API allows authenticated users to bypass access controls via specially crafted HTTP requests. The JSON API is disabled by default; exploitation requires authentication and, if using JSON API, that the API be explicitly enabled. An attacker gains the ability to execute commands outside the scope of their assigned role or permissions.

Affected products

  • Fortinet FortiAnalyzer 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12
  • Fortinet FortiAnalyzer Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12
  • Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12
  • Fortinet FortiManager Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12

Timeline

  • 2026-11-10: disclosed
  • 2026-11-11: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.