CVE-2026-126229: Fortinet FortiAnalyzer authorization bypass in dmserver

CVE-2026-126229 · Severity: critical · CVSS 9.1 · Published 2026-11-11

FortiAnalyzer and FortiManager are security management platforms used by enterprises to monitor and analyze network traffic and security events. An authenticated administrator could exploit a flaw in the authorization mechanism to gain unauthorized access to other isolated administrative domains (VDOMs) that they should not have permission to view or manage. This could lead to unauthorized access to sensitive security data, configuration changes, or disruption of network monitoring across multiple isolated security domains.

Technologies: Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager, Fortinet FortiManager Cloud. Vendors: Fortinet.

Quick answers

Is CVE-2026-126229 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126229 being exploited in the wild.
How severe is CVE-2026-126229?
Critical severity, with a CVSS score of 9.1, published 11 November 2026.
Which products and versions are affected?
Fortinet Fortianalyzer 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2 all versions, 7.0 all versions; Fortinet Fortianalyzer Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2 all versions, 7.0 all versions; Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2 all versions, 7.0 all versions; Fortinet FortiManager Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2 all versions, 7.0 all versions.
Is there a fix for CVE-2026-126229?
Yes: fixed in FortiAnalyzer 8.0.2 or above, 7.6.8 or above, 7.4.12 or above; FortiAnalyzer Cloud 8.0.2 or above, 7.6.8 or above, 7.4.12 or above; FortiManager 8.0.2 or above, 7.6.8 or above, 7.4.12 or above; FortiManager Cloud 8.0.2 or above, 7.6.8 or above, 7.4.12 or above. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126229 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126229?
Check whether you run Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: FortiAnalyzer 8.0.2 or above, 7.6.8 or above, 7.4.12 or above; FortiAnalyzer Cloud 8.0.2 or above, 7.6.8 or above, 7.4.12 or above; FortiManager 8.0.2 or above, 7.6.8 or above, 7.4.12 or above; FortiManager Cloud 8.0.2 or above, 7.6.8 or above, 7.4.12 or above

Technical details

An authorization bypass vulnerability exists in the dmserver API component due to insufficient validation of user-controlled keys in HTTP requests. An authenticated administrator can craft specially crafted HTTP requests to access VDOMs outside their assigned scope, bypassing the VDOM access control mechanism. The vulnerability requires existing administrator credentials to exploit.

Affected products

  • Fortinet FortiAnalyzer 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2 all versions, 7.0 all versions
  • Fortinet FortiAnalyzer Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2 all versions, 7.0 all versions
  • Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2 all versions, 7.0 all versions
  • Fortinet FortiManager Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2 all versions, 7.0 all versions

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.