CVE-2026-126217: High severity vulnerability

Published Nov 11, 2026

Updated

A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 8.0.2
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 8.0.2
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 8.0.2
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 8.0.2

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires an authenticated administrator account. The attacker must be able to send specially crafted requests to the GUI.

Which deployments are affected?

Affected products include FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud across the listed 7.2, 7.4, 7.6, and 8.0 version ranges. The specific affected starting versions differ for some Cloud 7.4 and 7.2 releases.

What could a successful attacker do?

An authenticated administrator may escalate privileges, bypass authorization controls, or impersonate internal services.