CVE-2026-126217 is an incorrect authorization vulnerability affecting multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated administrator to escalate privileges, bypass authorization controls, or impersonate internal services via specially crafted GUI requests. The vulnerability impacts versions from 7.2.0 through 8.0.1 across various release lines. A high-severity issue with a CVSS score of 8.7, it has an official fix available.
CVE-2026-126238 is an improper access control vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It allows an unauthenticated attacker to bypass authorization checks and gain unauthorized access to restricted functionality. The vulnerability has a high severity with a CVSS score of 8.6. An official fix is available from Fortinet.
CVE-2026-126225 is a high-severity missing authorization vulnerability affecting Fortinet FortiAnalyzer and FortiManager products, including their cloud versions. It impacts FortiAnalyzer versions 7.6.7 and 8.0.0 through 8.0.1, and FortiManager versions 7.6.7 and 8.0.0 through 8.0.1. An authenticated attacker can exploit this flaw by sending crafted JSON-RPC requests to escalate their privileges. The vulnerability has been officially fixed by Fortinet.
CVE-2026-126227 is an improper access control vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. The flaw allows an authenticated attacker to execute commands outside the intended scope by sending specially crafted HTTP requests. This vulnerability is classified as high severity with a CVSS score of 7.2. An official fix is available for the affected versions.
CVE-2026-126220 is a high-severity vulnerability in Fortinet FortiManager versions 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0. It involves improper neutralization of special elements in output used by a downstream component, allowing an authenticated administrator to execute unauthorized code or commands or read/write arbitrary files via specially crafted GUI requests. This vulnerability has an official fix available.
CVE-2026-126219 is a path traversal vulnerability in Fortinet FortiManager and FortiAnalyzer products, including their cloud versions. It affects multiple versions from 7.4.0 through 8.0.0. An authenticated administrator can exploit this flaw via specially crafted GUI requests to read or write arbitrary files or execute unauthorized code or commands.
CVE-2026-126235 is a path traversal vulnerability in Fortinet FortiManager and FortiAnalyzer products, including their cloud versions. It affects multiple versions ranging from 7.2.x through 8.0.1. This flaw allows an authenticated administrator to write arbitrary files via a specially crafted archive, potentially leading to unauthorized code or command execution. The vulnerability has a high severity rating with a CVSS score of 7.2. An official fix is available for the affected versions.
CVE-2026-126221 is a vulnerability in Fortinet FortiManager and FortiAnalyzer products that allows an authenticated administrator to execute unauthorized code or commands via specially crafted requests to the GUI. This issue arises from improper neutralization of special elements in output used by downstream components, leading to injection attacks. Affected versions include FortiManager and FortiAnalyzer releases from 7.4.0 through 8.0.0. The vulnerability has a high severity rating with a CVSS score of 7.2. An official fix is available to address this issue.
CVE-2026-126237 is a high-severity vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It involves an infinite loop caused by a loop with an unreachable exit condition triggered by crafted TCP requests, leading to denial of service (DoS).
CVE-2026-126234 is a vulnerability in Fortinet FortiManager 8.0.0 and related products where improper neutralization of special elements in a template engine allows an authenticated attacker with restricted privileges to execute unauthorized code or commands. This vulnerability has a high severity rating and affects version 8.0.0 of FortiManager. An official fix is available.
CVE-2026-126243 is an improper authorization vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. This flaw may allow an attacker to bypass authentication controls and gain unauthorized access. However, full impersonation requires the attacker to have obtained certain IDs and data through other means. The vulnerability has a high severity rating with a CVSS score of 7.2. An official fix is available from Fortinet.
CVE-2026-126233 is a high-severity vulnerability in Fortinet FortiManager and FortiAnalyzer products that allows an authenticated administrator to upload arbitrary files via specially crafted requests. This unrestricted file upload flaw affects multiple versions of FortiManager and FortiAnalyzer, including their cloud variants. Exploitation could lead to execution of unauthorized code or commands, impacting confidentiality, integrity, and availability.
CVE-2026-126242 is an improper access control vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. This flaw may allow an attacker to bypass authentication and gain unauthorized access. However, full impersonation requires the attacker to have obtained certain IDs and data through other means. The vulnerability has a high severity rating with a CVSS score of 7.4. An official fix is available from Fortinet.
CVE-2026-126222 is a path traversal vulnerability affecting Fortinet FortiAnalyzer and FortiManager products, including their cloud versions, in specified versions. It allows an authenticated attacker with administrative privileges to execute unauthorized code or commands by sending crafted requests. The vulnerability impacts versions 7.6.3 through 7.6.7 and 8.0.0 through 8.0.1 of FortiManager and FortiAnalyzer. A fix is available from the vendor.
CVE-2026-126211 is an improper privilege management vulnerability affecting Fortinet FortiAnalyzer and FortiManager products, including their cloud versions. It impacts FortiAnalyzer versions 7.6.1 through 7.6.7 and 8.0.0 through 8.0.1, FortiAnalyzer Cloud versions 7.6.1 through 7.6.8 and 8.0.0 through 8.0.1, FortiManager versions 7.6.1 through 7.6.7 and 8.0.0 through 8.0.1, and FortiManager Cloud versions 7.6.1 through 7.6.8 and 8.0.0 through 8.0.1. An authenticated privileged attacker may exploit this flaw by sending a crafted JSON-RPC request to elevate their privileges. The vulnerability has a high CVSS score of 7.2. Official patches are available to address this issue.
CVE-2026-126213 is a high-severity SQL injection vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. The flaw allows an authenticated attacker to execute unauthorized SQL commands via specially crafted requests. This vulnerability impacts versions 7.2.x through 8.0.1 of FortiManager and FortiAnalyzer. An official fix is available to address this issue.
CVE-2026-126218 is an improper access control vulnerability in Fortinet FortiManager versions 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0 through 8.0.1. It allows a remote authenticated attacker with admin permissions to escalate their privileges to root by exploiting an authorization bypass via crafted HTTP requests. The vulnerability has a high severity score of 8.2 and has been officially fixed by Fortinet.
CVE-2026-126185 is a code injection vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. It allows an authenticated administrator to execute unauthorized code or commands via specially crafted requests. The vulnerability affects FortiManager versions 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0 through 8.0.1, as well as corresponding FortiAnalyzer versions and cloud editions. A patch is available and has been officially released to address this issue.
CVE-2026-126232 is an improper certificate validation vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. This flaw may allow a man-in-the-middle (MITM) attacker to impersonate a RADIUS server by exploiting the improper validation of certificates. The vulnerability affects FortiAnalyzer versions 7.2 through 8.0.1 and FortiManager versions 7.2 through 8.0.1, including cloud editions. A fix is available from the vendor.
CVE-2026-126226 is an OS command injection vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. An authenticated privileged attacker can exploit this flaw by crafting a malicious report schedule name to execute unauthorized code or commands on the affected system. The vulnerability impacts versions 7.2.x through 8.0.0 of FortiManager and FortiAnalyzer. A fix is officially available from the vendor.