CVE-2026-126227: High severity vulnerability

Published Nov 11, 2026

Updated

A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the intended scope via specially crafted HTTP request

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 8.0.2
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 8.0.2
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 8.0.2
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 8.0.2

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must be authenticated and able to send specially crafted HTTP requests. The provided data does not indicate that unauthenticated exploitation is possible.

Which deployments should be checked for exposure?

Check FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud deployments running the affected 7.2, 7.4, 7.6, or 8.0 release ranges. Both appliance and Cloud product variants are listed as affected, with version ranges differing slightly by product.

What could an attacker do after exploiting the vulnerability?

An authenticated attacker may execute commands outside their intended scope by using a specially crafted HTTP request. The vulnerability is rated high severity and impacts confidentiality, integrity, and availability.

How can I determine whether a system is affected?

Identify the product and installed version, then compare it with the listed affected ranges. For example, FortiAnalyzer and FortiManager versions from 7.2.0 through 7.2.12, 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0 through 8.0.1 are affected.

CVE-2026-126227: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which deployments should be checked for exposure?

What could an attacker do after exploiting the vulnerability?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which deployments should be checked for exposure?

What could an attacker do after exploiting the vulnerability?

How can I determine whether a system is affected?