Is CVE-2026-126236 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126236 being exploited in the wild.

How severe is CVE-2026-126236?

High severity, with a CVSS score of 7.2, published 11 November 2026.

Which products and versions are affected?

Fortinet Fortianalyzer 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12; Fortinet Fortianalyzer Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12; Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12; Fortinet FortiManager Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12; and 1 more.

Is there a fix for CVE-2026-126236?

Yes: fixed in FortiAnalyzer 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiAnalyzer Cloud 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiManager 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiManager Cloud 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiSASE-Sovereign 26.2 (not released). Until then: If the JSON API is enabled on a profile, disable it via the configuration command: config system admin profile edit <profile name> set rpc-permit none end Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126236 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126236?

Check whether you run Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126236: Fortinet FortiAnalyzer OS command injection in GUI

CVE-2026-126236 · Severity: high · CVSS 7.2 · Published 2026-11-11

FortiAnalyzer is a centralized logging and analysis platform used to monitor security events across enterprise networks. An authenticated attacker can inject arbitrary OS commands through the web GUI, potentially gaining full system control and accessing sensitive log data. This requires valid credentials but no additional user interaction.

Technologies: Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager, Fortinet FortiManager Cloud, Fortinet FortiSASE-Sovereign. Vendors: Fortinet.

Quick answers

Is CVE-2026-126236 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126236 being exploited in the wild.
How severe is CVE-2026-126236?: High severity, with a CVSS score of 7.2, published 11 November 2026.
Which products and versions are affected?: Fortinet Fortianalyzer 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12; Fortinet Fortianalyzer Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12; Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12; Fortinet FortiManager Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12; and 1 more.
Is there a fix for CVE-2026-126236?: Yes: fixed in FortiAnalyzer 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiAnalyzer Cloud 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiManager 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiManager Cloud 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiSASE-Sovereign 26.2 (not released). Until then: If the JSON API is enabled on a profile, disable it via the configuration command: config system admin profile edit <profile name> set rpc-permit none end Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126236 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126236?: Check whether you run Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet FortiManager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiAnalyzer 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiAnalyzer Cloud 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiManager 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiManager Cloud 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiSASE-Sovereign 26.2 (not released)

If the JSON API is enabled on a profile, disable it via the configuration command: config system admin profile edit <profile name> set rpc-permit none end

Technical details

An OS command injection vulnerability (CWE-78) exists in the GUI API of FortiAnalyzer, FortiManager, and FortiSASE-Sovereign, triggered via specially crafted HTTP requests. The vulnerability requires authentication and can be exploited through the JSON API if it is enabled (disabled by default). An attacker with valid credentials can execute arbitrary code with the privileges of the affected service.

Affected products

Fortinet FortiAnalyzer 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12
Fortinet FortiAnalyzer Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12
Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12
Fortinet FortiManager Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12
Fortinet FortiSASE-Sovereign 25, 25.3, 25.4, 26.2

Timeline

2026-11-10: disclosed

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-251

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.