CVE-2026-126231: Fortinet FortiAnalyzer and FortiManager OS command injection

CVE-2026-126231 · Severity: high · CVSS 7.2 · Published 2026-11-11

FortiAnalyzer and FortiManager are centralized management and analytics platforms used by enterprises to monitor and control their security infrastructure. A command injection vulnerability in these products allows authenticated users to execute arbitrary system commands, potentially leading to complete compromise of the management infrastructure and access to sensitive security data across the entire enterprise network.

Technologies: Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager, Fortinet FortiManager Cloud. Vendors: Fortinet.

Quick answers

Is CVE-2026-126231 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126231 being exploited in the wild.
How severe is CVE-2026-126231?
High severity, with a CVSS score of 7.2, published 11 November 2026.
Which products and versions are affected?
Fortinet Fortianalyzer 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2 all versions; Fortinet Fortianalyzer Cloud 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2 all versions; Fortinet FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2 all versions; Fortinet FortiManager Cloud 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2 all versions.
Is there a fix for CVE-2026-126231?
Yes: fixed in FortiAnalyzer 8.0.1 or above, 7.6.8 or above, 7.4.12 or above; FortiAnalyzer Cloud 7.6.8 or above, 7.4.12 or above; FortiManager 8.0.1 or above, 7.6.8 or above, 7.4.12 or above; FortiManager Cloud 7.6.8 or above, 7.4.12 or above. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126231 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126231?
Check whether you run Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: FortiAnalyzer 8.0.1 or above, 7.6.8 or above, 7.4.12 or above; FortiAnalyzer Cloud 7.6.8 or above, 7.4.12 or above; FortiManager 8.0.1 or above, 7.6.8 or above, 7.4.12 or above; FortiManager Cloud 7.6.8 or above, 7.4.12 or above

Technical details

The vulnerability is an improper neutralization of special elements in OS commands (CWE-78) located in the system-ha plugin CLI component. An authenticated attacker can craft a malicious HTTP request to execute unauthorized commands with the privileges of the management application. The vulnerability requires authentication but no user interaction, affecting the central point of security management for enterprise networks.

Affected products

  • Fortinet FortiAnalyzer 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2 all versions
  • Fortinet FortiAnalyzer Cloud 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2 all versions
  • Fortinet FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2 all versions
  • Fortinet FortiManager Cloud 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2 all versions

Timeline

  • 2026-11-10: disclosed: Initial publication by Fortinet PSIRT

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.