CVE-2026-126230: High severity vulnerability
A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted requests.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 8.0.2 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 8.0.2 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 8.0.2 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated administrator account. An attacker must send specially crafted requests, so unauthenticated network access alone is not sufficient based on the available information.
Which deployments and releases are affected?
Affected products include FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud across the listed 7.2, 7.4, 7.6, and 8.0 release ranges. The exact affected starting version differs for some Cloud 7.2 and 7.4 branches: they begin at 7.2.1 and 7.4.1, respectively.
What could a successful attacker do?
An authenticated administrator may be able to execute unauthorized code or commands, or cause a denial of service. The vulnerability is rated high severity with a 7.2 score.