Is CVE-2026-126230 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126230 being exploited in the wild.

How severe is CVE-2026-126230?

High severity, with a CVSS score of 7.2, published 11 November 2026.

Which products and versions are affected?

Fortinet Fortianalyzer 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12; Fortinet Fortianalyzer Cloud 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12; Fortinet FortiManager 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12; Fortinet FortiManager Cloud 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12.

Is there a fix for CVE-2026-126230?

Yes: fixed in FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiAnalyzer Cloud 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiManager 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiManager Cloud 8.0.2, 7.6.8, 7.4.12, 7.2.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126230 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126230?

Check whether you run Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126230: Fortinet FortiAnalyzer format string vulnerability

CVE-2026-126230 · Severity: high · CVSS 7.2 · Published 2026-11-11

Fortinet FortiAnalyzer and FortiManager are centralized management and logging platforms for enterprise security appliances. A format string flaw allows authenticated administrators to execute arbitrary code or commands or crash the system through malicious requests. This could allow a rogue admin to take full control of the management infrastructure or disable logging and monitoring across all protected networks.

Technologies: Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager, Fortinet FortiManager Cloud. Vendors: Fortinet.

Quick answers

Is CVE-2026-126230 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126230 being exploited in the wild.
How severe is CVE-2026-126230?: High severity, with a CVSS score of 7.2, published 11 November 2026.
Which products and versions are affected?: Fortinet Fortianalyzer 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12; Fortinet Fortianalyzer Cloud 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12; Fortinet FortiManager 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12; Fortinet FortiManager Cloud 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12.
Is there a fix for CVE-2026-126230?: Yes: fixed in FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiAnalyzer Cloud 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiManager 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiManager Cloud 8.0.2, 7.6.8, 7.4.12, 7.2.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126230 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126230?: Check whether you run Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiAnalyzer Cloud 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiManager 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiManager Cloud 8.0.2, 7.6.8, 7.4.12, 7.2.13

Technical details

A format string vulnerability (CWE-134) in the API component allows an authenticated administrator to inject format string specifiers in requests, leading to information disclosure, memory corruption, or code execution. The vulnerability requires administrator-level authentication and a specially crafted request, but carries a CVSS score of 7.2 due to the potential for unauthorized code execution.

Affected products

Fortinet FortiAnalyzer 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12
Fortinet FortiAnalyzer Cloud 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12
Fortinet FortiManager 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12
Fortinet FortiManager Cloud 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12

Timeline

2026-11-10: disclosed: Advisory published by Fortinet PSIRT

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-245

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.