FG-IR-26-227: Improper control of generation of code in GUI
Published Nov 10, 2026
·Updated
An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] and a Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability [CWE-120] in FortiManager, FortiAnalyzer, FortiManager Cloud, and FortiAnalyzer Cloud may allow a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
Affected Software
20 affected componentsFixes available
Fortinet FortiAnalyzer>=8.0.0<=8.0.1
Fortinet FortiAnalyzer>=7.6.0<=7.6.7
Fortinet FortiAnalyzer>=7.4.0<=7.4.11
Fortinet FortiAnalyzer>=7.2.0<=7.2.12
Fortinet FortiAnalyzer Cloud>=8.0.0<=8.0.1
Fortinet FortiAnalyzer Cloud>=7.6.0<=7.6.7
Fortinet FortiAnalyzer Cloud>=7.4.1<=7.4.11
Fortinet FortiAnalyzer Cloud>=7.2.1<=7.2.12
Fortinet FortiManager>=8.0.0<=8.0.1
Fortinet FortiManager>=7.6.0<=7.6.7
Fortinet FortiManager>=7.4.0<=7.4.11
Fortinet FortiManager>=7.2.0<=7.2.12
Fortinet FortiManager Cloud>=8.0.0<=8.0.1
Fortinet FortiManager Cloud>=7.6.0<=7.6.7
Fortinet FortiManager Cloud>=7.4.1<=7.4.11
Fortinet FortiManager Cloud>=7.2.1<=7.2.12
Fortinet FortiSASE-Sovereign>=26.2
Fortinet FortiSASE-Sovereign>=25.4
Fortinet FortiSASE-Sovereign>=25.3
Fortinet FortiSASE-Sovereign>=25
Event History
Nov 10, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software