CVE-2026-126176: High severity vulnerability

Published Nov 11, 2026

Updated

A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 8.0.1
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 8.0.1
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 8.0.1
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 8.0.1

Event History

Nov 11, 2026

CVE Published

via MITRE·09:30 PM

Data Sourced

via MITRE·09:30 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

The affected products are FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud in the listed 7.2, 7.4, 7.6, and 8.0 releases. The affected version ranges differ slightly between the standard and Cloud offerings, particularly for the 7.4 and 7.2 Cloud releases.

Does an attacker need an account or user interaction to exploit this?

No. The vulnerability is described as exploitable remotely by an unauthenticated attacker, and no user interaction is required. Exploitation requires the attacker to send crafted SAML requests.

What can an attacker do if exploitation succeeds?

An attacker may inject arbitrary content into a signed SAML response. The provided severity vector indicates potential impacts to confidentiality, integrity, and availability, with integrity rated high.

CVE-2026-126176: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need an account or user interaction to exploit this?

What can an attacker do if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need an account or user interaction to exploit this?

What can an attacker do if exploitation succeeds?