CVE-2026-126184 is a high-severity vulnerability in Fortinet FortiManager and FortiAnalyzer products, including their cloud versions. It involves an authentication bypass by spoofing that may allow an attacker to disrupt the High Availability (HA) state. The affected versions span multiple releases from 7.2.0 through 8.0.1. An official fix is available for this vulnerability.
A heap-based buffer overflow vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests. The vulnerability affects FortiAnalyzer versions 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0 through 8.0.1, as well as FortiManager versions 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0 through 8.0.1. A fix is officially available for these vulnerabilities.
CVE-2026-126183 is an authorization bypass vulnerability in Fortinet FortiManager and FortiManager Cloud versions 7.2.0 through 8.0.1. It allows an authenticated attacker to execute commands outside their expected scope by sending specially crafted HTTP requests. The vulnerability affects multiple versions across FortiManager and FortiManager Cloud products. A patch is available and has been officially released by the vendor.
CVE-2026-126182 is a code injection vulnerability in Fortinet FortiManager and FortiManager Cloud versions 7.2.0 through 8.0.1. It allows a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests. The vulnerability affects multiple versions across several release lines. An official fix is available to address this issue.
CVE-2026-126176 is a high-severity XML injection vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. The flaw allows an unauthenticated remote attacker to inject arbitrary content into a signed SAML response via crafted SAML requests, potentially leading to denial of service and integrity issues. The vulnerability impacts FortiManager versions 7.2.0 through 8.0.0 and FortiAnalyzer versions 7.2.0 through 8.0.0, among others. An official fix is available to address this issue.
CVE-2026-126177 is a high-severity XML injection vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. The flaw allows an unauthenticated remote attacker to inject arbitrary content into a signed SAML response by sending crafted SAML requests. This vulnerability can lead to denial of service and potentially impact the integrity of SAML authentication responses.
CVE-2026-126178 is a heap-based buffer overflow vulnerability affecting multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated attacker with administrative privileges to execute unauthorized code or commands by sending a crafted request. The vulnerability impacts versions 7.2.0 through 8.0.1 across several release lines. A patch is available from Fortinet to address this issue.
CVE-2026-126175 is a high-severity SQL injection vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. The flaw allows an authenticated attacker to execute unauthorized code or commands by sending crafted JSON-RPC requests. The vulnerability impacts FortiAnalyzer versions 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, and 7.2.2 through 7.2.12, as well as FortiManager versions 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, and 7.2.2 through 7.2.12, including their respective cloud versions. An official fix is available for this vulnerability.
CVE-2026-126179 is an OS command injection vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. It allows an authenticated administrator to execute unauthorized code or commands via specially crafted requests. The vulnerability impacts versions 7.2.x through 8.0.0 of FortiManager and FortiAnalyzer. A fix is officially available.
CVE-2026-126169 is a vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.2. It involves improper neutralization of argument delimiters leading to argument injection. An authenticated attacker with domain admin or admin privileges can exploit this flaw via crafted HTTP requests to the administrative interface to execute arbitrary code as root, run arbitrary CLI commands, delete users on a paired FortiAuthenticator, and read or write arbitrary files as root. The vulnerability has a high severity with a CVSS score of 7.2. Official patches are available to remediate the issue.
CVE-2026-126166 is a high-severity vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.2. It involves improper neutralization of argument delimiters leading to argument injection. An authenticated attacker with domain admin or admin privileges can exploit this flaw via crafted HTTP requests to the administrative interface to execute arbitrary code as root, run arbitrary CLI commands, delete users on paired FortiAuthenticator devices, and read or write arbitrary files as root. An official fix is available for this vulnerability.
CVE-2026-126170 is a critical vulnerability in Fortinet FortiManager and related FortiAnalyzer products that allows an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request. The flaw is due to improper encoding or escaping of output. It affects multiple versions of FortiManager and FortiAnalyzer, including cloud and BigData variants. A patch is available from the vendor.
CVE-2026-126168 is a vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.2. It involves improper neutralization of argument delimiters in commands, allowing an authenticated attacker with domain admin or admin privileges to execute arbitrary code as root, run arbitrary CLI commands, delete users on a paired FortiAuthenticator, and read or write arbitrary files via crafted HTTP requests to the administrative interface. The vulnerability has a high severity with a CVSS score of 7.2. An official fix is available.
CVE-2026-126180 is a high-severity vulnerability in Fortinet FortiManager versions 7.2 through 8.0.1 and corresponding FortiManager Cloud versions. It involves improper neutralization of special elements in a template engine, allowing a low privileged Device Manager admin to escalate privileges to super admin on managed FortiGate devices by injecting malicious commands. This vulnerability affects multiple FortiManager releases and has an official fix available.
CVE-2026-126171 is a high-severity vulnerability affecting multiple versions of Fortinet FortiManager and FortiAnalyzer products, including their cloud variants. It involves a use of externally-controlled format string vulnerability that may allow an authenticated attacker to execute unauthorized commands via specially crafted HTTP requests. The vulnerability affects versions from 7.0.0 through 8.0.1 in various sub-versions. An official fix is available to address this issue.
CVE-2026-126167 is a command injection vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.2. An authenticated attacker with domain admin or admin privileges can exploit this flaw via crafted HTTP requests to the administrative interface. Successful exploitation allows deletion of users on paired FortiAuthenticator devices, execution of arbitrary code as root, execution of arbitrary CLI commands, and reading or writing arbitrary files as root.
CVE-2026-126181 is a high-severity vulnerability in Fortinet FortiManager versions 7.2.0 through 7.2.13, 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0 through 8.0.1. It involves the use of hard-coded credentials that may allow an adjacent-network authenticated attacker with user permissions to join the FGFM configuration-sync mesh via the default pre-shared key, potentially causing denial of service and impacting confidentiality, integrity, and availability.
CVE-2026-126164 is a critical SQL injection vulnerability in Fortinet FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests, potentially leading to denial of service and compromise of confidentiality and integrity. An official fix is available for the affected versions.
CVE-2026-126163 is a high-severity vulnerability in Fortinet FortiMail versions 8.0.0 through 8.0.1. It involves a use of externally-controlled format string flaw that could allow a remote unauthenticated attacker to execute unauthorized code or commands by sending a specially crafted SMTP command. An official fix is available for this issue.
CVE-2026-126165 is a high-severity denial of service vulnerability in Fortinet FortiMail versions 7.0.0 through 8.0.1. It involves a memory allocation with an excessive size value triggered by a specially crafted email attachment delivered over SMTP, allowing a remote unauthenticated attacker to cause service disruption.