# Fortinet FortiAnalyzer vulnerabilities Source: https://junglewise.ai/threats/technologies/fortianalyzer Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/fortianalyzer.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 47 vulnerabilities in Fortinet FortiAnalyzer: 36 in the last 7 days and 41 in the last 90 days, 4 of them critical and 1 exploited in the wild. The most recent, CVE-2026-126262, was published on 11 November 2026. 4 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 36 - Last 30 days: 36 - Last 90 days: 41 - All time: 47 (4 critical, 1 exploited in the wild) ## About Fortinet FortiAnalyzer Security information and event management platform for collecting and analyzing logs. ## Latest Fortinet FortiAnalyzer vulnerabilities - [CVE-2026-126262: Fortinet FortiAnalyzer and FortiManager SQL injection in OFTP](https://junglewise.ai/threats/cve-2026-126262-a-improper-neutralization-of-special-elements-used-in-an-sql) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126236: Fortinet FortiAnalyzer OS command injection in GUI](https://junglewise.ai/threats/cve-2026-126236-a-improper-neutralization-of-special-elements-used-in-an-os) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126235: Fortinet FortiAnalyzer and FortiManager path traversal in archive handling](https://junglewise.ai/threats/cve-2026-126235-a-improper-limitation-of-a-pathname-to-a-restricted-directory) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126234: Fortinet FortiAnalyzer and FortiManager template injection](https://junglewise.ai/threats/cve-2026-126234-a-improper-neutralization-of-special-elements-used-in-a-template) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126233: Fortinet FortiAnalyzer unrestricted upload of dangerous file types](https://junglewise.ai/threats/cve-2026-126233-a-unrestricted-upload-of-file-with-dangerous-type-vulnerability) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126232: Fortinet FortiAnalyzer improper certificate validation in RADIUS](https://junglewise.ai/threats/cve-2026-126232-a-improper-certificate-validation-vulnerability-in-fortinet) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126231: Fortinet FortiAnalyzer and FortiManager OS command injection](https://junglewise.ai/threats/cve-2026-126231-a-improper-neutralization-of-special-elements-used-in-an-os) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126230: Fortinet FortiAnalyzer format string vulnerability](https://junglewise.ai/threats/cve-2026-126230-a-use-of-externally-controlled-format-string-vulnerability-in) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126229: Fortinet FortiAnalyzer authorization bypass in dmserver](https://junglewise.ai/threats/cve-2026-126229-a-authorization-bypass-through-user-controlled-key-vulnerability) (critical, CVSS 9.1, published 11 Nov 2026) - [CVE-2026-126228: Fortinet FortiManager and FortiAnalyzer out-of-bounds write in dmworker](https://junglewise.ai/threats/cve-2026-126228-a-out-of-bounds-write-vulnerability-in-fortinet-fortianalyzer-8) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126227: Fortinet FortiAnalyzer and FortiManager confused deputy in GUI](https://junglewise.ai/threats/cve-2026-126227-a-unintended-proxy-or-intermediary-confused-deputy-vulnerability) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126226: Fortinet FortiAnalyzer OS command injection in report schedule](https://junglewise.ai/threats/cve-2026-126226-a-improper-neutralization-of-special-elements-used-in-an-os) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126225: Fortinet FortiAnalyzer privilege escalation via JSON-RPC](https://junglewise.ai/threats/cve-2026-126225-a-missing-authorization-vulnerability-in-fortinet-fortianalyzer) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-126224: Fortinet FortiAnalyzer and FortiManager argument injection](https://junglewise.ai/threats/cve-2026-126224-a-improper-neutralization-of-argument-delimiters-in-a-command) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126223: Fortinet FortiAnalyzer stack-based buffer overflow in JSON-RPC API](https://junglewise.ai/threats/cve-2026-126223-a-stack-based-buffer-overflow-vulnerability-in-fortinet) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126222: Fortinet FortiAnalyzer path traversal vulnerability](https://junglewise.ai/threats/cve-2026-126222-a-improper-limitation-of-a-pathname-to-a-restricted-directory) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126221: Fortinet FortiAnalyzer path traversal and injection in GUI](https://junglewise.ai/threats/cve-2026-126221-a-improper-neutralization-of-special-elements-in-output-used-by) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126220: Fortinet FortiManager injection in GUI](https://junglewise.ai/threats/cve-2026-126220-a-improper-neutralization-of-special-elements-in-output-used-by) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126219: Fortinet FortiAnalyzer and FortiManager path traversal in GUI](https://junglewise.ai/threats/cve-2026-126219-a-improper-limitation-of-a-pathname-to-a-restricted-directory) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126217: Fortinet FortiAnalyzer and FortiManager authorization bypass in GUI](https://junglewise.ai/threats/cve-2026-126217-a-incorrect-authorization-vulnerability-in-fortinet) (high, CVSS 8.7, published 11 Nov 2026) - [CVE-2026-126215: Fortinet FortiAnalyzer authorization bypass in GUI](https://junglewise.ai/threats/cve-2026-126215-a-incorrect-authorization-vulnerability-in-fortinet) (high, CVSS 8.2, published 11 Nov 2026) - [CVE-2026-126214: Fortinet FortiAnalyzer authentication bypass in GUI](https://junglewise.ai/threats/cve-2026-126214-a-authentication-bypass-by-spoofing-vulnerability-in-fortinet) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126213: Fortinet FortiAnalyzer and FortiManager SQL injection in GUI](https://junglewise.ai/threats/cve-2026-126213-a-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-126212: Fortinet FortiAnalyzer heap-based buffer overflow in JSON-RPC API](https://junglewise.ai/threats/cve-2026-126212-a-heap-based-buffer-overflow-vulnerability-in-fortinet) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126211: Fortinet FortiAnalyzer and FortiManager privilege escalation](https://junglewise.ai/threats/cve-2026-126211-a-improper-privilege-management-vulnerability-in-fortinet) (high, CVSS 7.2, published 11 Nov 2026) ## Most severe Fortinet FortiAnalyzer vulnerabilities - [CVE-2026-24858: Fortinet Multiple Products authentication bypass in FortiCloud SSO](https://junglewise.ai/threats/cve-2026-24858-fortinet-multiple-products-authentication-bypass-in-forticloud) (critical, exploited in the wild, CVSS 9.8, published 27 Jan 2026) - [CVE-2026-126262: Fortinet FortiAnalyzer and FortiManager SQL injection in OFTP](https://junglewise.ai/threats/cve-2026-126262-a-improper-neutralization-of-special-elements-used-in-an-sql) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126170: Fortinet FortiAnalyzer improper encoding of output in JRPC API](https://junglewise.ai/threats/cve-2026-126170-a-improper-encoding-or-escaping-of-output-vulnerability-in) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126229: Fortinet FortiAnalyzer authorization bypass in dmserver](https://junglewise.ai/threats/cve-2026-126229-a-authorization-bypass-through-user-controlled-key-vulnerability) (critical, CVSS 9.1, published 11 Nov 2026) - [CVE-2025-46773: Fortinet FortiAnalyzer SQL injection](https://junglewise.ai/threats/cve-2025-46773-an-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-126175: Fortinet FortiAnalyzer SQL injection in JSON-RPC API](https://junglewise.ai/threats/cve-2026-126175-a-improper-neutralization-of-special-elements-used-in-an-sql) (high, CVSS 8.8, published 11 Nov 2026) - [CVE-2026-126217: Fortinet FortiAnalyzer and FortiManager authorization bypass in GUI](https://junglewise.ai/threats/cve-2026-126217-a-incorrect-authorization-vulnerability-in-fortinet) (high, CVSS 8.7, published 11 Nov 2026) - [CVE-2026-126215: Fortinet FortiAnalyzer authorization bypass in GUI](https://junglewise.ai/threats/cve-2026-126215-a-incorrect-authorization-vulnerability-in-fortinet) (high, CVSS 8.2, published 11 Nov 2026) - [CVE-2026-126184: Fortinet FortiAnalyzer authentication bypass by spoofing](https://junglewise.ai/threats/cve-2026-126184-a-authentication-bypass-by-spoofing-vulnerability-in-fortinet) (high, CVSS 8.2, published 11 Nov 2026) - [CVE-2026-126177: Fortinet FortiAnalyzer XML injection in SAML](https://junglewise.ai/threats/cve-2026-126177-a-xml-injection-aka-blind-xpath-injection-vulnerability-in) (high, CVSS 8.1, published 11 Nov 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 4 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 36 | 3 | 0 | ## Other Fortinet technologies - [Fortinet FortiOS](https://junglewise.ai/threats/technologies/fortios): 66 vulnerabilities - [Fortinet FortiManager](https://junglewise.ai/threats/technologies/fortimanager): 54 vulnerabilities - [Fortinet FortiManager Cloud](https://junglewise.ai/threats/technologies/fortimanager-cloud): 48 vulnerabilities - [Fortinet Fortianalyzer Cloud](https://junglewise.ai/threats/technologies/fortianalyzer-cloud): 42 vulnerabilities - [Fortinet FortiProxy](https://junglewise.ai/threats/technologies/fortiproxy): 35 vulnerabilities - [Fortinet FortiMail](https://junglewise.ai/threats/technologies/fortimail): 31 vulnerabilities - [Fortinet FortiAuthenticator](https://junglewise.ai/threats/technologies/fortiauthenticator): 22 vulnerabilities - [Fortinet FortiSandbox](https://junglewise.ai/threats/technologies/fortisandbox): 17 vulnerabilities - [Fortinet FortiWeb](https://junglewise.ai/threats/technologies/fortiweb): 16 vulnerabilities - [Fortinet Fortisase](https://junglewise.ai/threats/technologies/fortisase): 13 vulnerabilities - [Fortinet FortiPAM](https://junglewise.ai/threats/technologies/fortipam): 12 vulnerabilities - [Fortinet FortiSandbox Cloud](https://junglewise.ai/threats/technologies/fortisandbox-cloud): 12 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Fortinet FortiAnalyzer vulnerabilities", https://junglewise.ai/threats/technologies/fortianalyzer, 13 November 2026.