CVE-2026-126262: SQL Injection

Published Nov 11, 2026

Updated

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 8.0.2
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.2.13
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 8.0.1

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

Affected FortiAnalyzer and FortiManager systems are exposed if an unauthenticated attacker can access their OFTP port. The issue affects the listed version ranges, including FortiManager 8.0.0.

Does exploitation require credentials or user interaction?

No. The vulnerability is described as exploitable by an unauthenticated attacker using crafted OFTP packets, with no user interaction required.

What could a successful attacker do?

A successful attacker may execute code or commands on the affected system. The supplied severity vector indicates high potential impact to confidentiality, integrity, and availability.