A stack-based buffer overflow vulnerability exists in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. This flaw may allow an unauthenticated attacker to cause a denial of service by crashing the FSSO subsystem via specially crafted HTTP requests.
An unrestricted file upload vulnerability exists in Fortinet FortiAnalyzer and FortiManager products, including their cloud versions, across multiple versions. This flaw allows an authenticated administrator to upload arbitrary files via specially crafted requests, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability affects FortiAnalyzer versions 7.2.0 through 8.0.1 and FortiManager versions 7.2.0 through 8.0.1, including corresponding cloud versions. The CVSS score is 7.2, indicating high severity.
An improper neutralization of special elements vulnerability exists in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, and FortiManager Cloud 8.0.0. This flaw may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands via a specially crafted request. The vulnerability has a high severity rating with a CVSS score of 7.2.
An improper certificate validation vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw may allow a man-in-the-middle (MITM) attacker to impersonate a RADIUS server by presenting a rogue RADIUS server certificate. The vulnerability affects FortiAnalyzer versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, and all versions of 7.2, as well as corresponding FortiAnalyzer Cloud versions. Similarly, FortiManager versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, and all versions of 7.2, including their cloud variants, are affected. The vulnerability is identified as CWE-295 and has a CVSS v3.1 base score of 7.5 (high severity). No public exploits or patches are currently documented.
CVE-2026-126240 is an LDAP injection vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. It allows an authenticated attacker to bypass authentication if the attacker can control the NameID or SAML attribute used as the username, typically via a malicious or compromised upstream Identity Provider (IdP) or an IdP configuration that permits such control.
A format string vulnerability exists in Fortinet FortiAnalyzer and FortiManager products, including their cloud versions, across multiple 7.x and 8.x releases. This flaw allows an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted requests.
An infinite loop vulnerability exists in Fortinet FortiAuthenticator versions 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. This flaw allows an attacker to cause a denial of service by sending specially crafted TCP requests that trigger a loop with an unreachable exit condition.
An incorrect authorization vulnerability exists in Fortinet FortiAuthenticator versions 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. This flaw may allow an unauthenticated attacker to bypass authorization checks and gain unauthorized access to restricted functionality.
An OS command injection vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated attacker to execute unauthorized OS commands via a crafted HTTP request. The vulnerability affects FortiAnalyzer versions 7.2 all versions, 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0, as well as FortiManager versions 7.2 all versions, 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0, including their respective cloud versions. The CVSS v3.1 base score is 7.2, indicating a high severity impact with high confidentiality, integrity, and availability impact. No patch or remediation information is provided in the source data.
An SQL injection vulnerability exists in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. This flaw allows an authenticated attacker to execute unauthorized SQL commands on the underlying database, potentially leading to full compromise of confidentiality, integrity, and availability of the system.
An incorrect authorization vulnerability exists in Fortinet FortiAuthenticator versions 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. This flaw may allow an attacker to bypass authentication and gain unauthorized access. However, full impersonation requires the attacker to have obtained certain IDs and data through other means.
CVE-2026-126229 is a critical authorization bypass vulnerability affecting multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. It allows an authenticated administrator to access other Virtual Domains (VDOMs) via specially crafted HTTP requests, potentially leading to full compromise of confidentiality, integrity, and availability of affected systems.
A resource allocation vulnerability exists in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.10 and 8.0.0 through 8.0.3. This flaw allows an unauthenticated attacker to exhaust system resources without any limits or throttling, potentially causing a denial of service (DoS) condition.
An OS command injection vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated privileged attacker to execute unauthorized commands by exploiting crafted report schedule names. The vulnerability affects versions from 7.2.0 up to certain later versions, with no explicit fixed versions provided. The CVSS score is 7.2, indicating a high severity risk.
CVE-2026-126219 is a path traversal vulnerability affecting multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted GUI requests. The vulnerability impacts FortiAnalyzer versions 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0; FortiManager versions 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0; and their respective cloud versions. The CVSS v3.1 base score is 7.2, indicating a high severity level. No public exploits or patches are currently documented in the provided data.
An incorrect authorization vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw may allow an authenticated administrator to escalate privileges, bypass authorization controls, or impersonate internal services via specially crafted GUI requests. The vulnerability affects versions from 7.2.0 through 8.0.1 across these products. It has a high severity rating with a CVSS score of 8.7.
CVE-2026-126220 is an injection vulnerability in Fortinet FortiManager versions 8.0.0, 7.6.0 through 7.6.7, and 7.4.0 through 7.4.11. It allows an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.
A stack-based buffer overflow vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests. The vulnerability affects versions 7.4.x, 7.6.x, and 8.0.x of these products.
An improper privilege management vulnerability exists in multiple versions of Fortinet FortiManager and FortiManager Cloud. This flaw may allow an authenticated administrator to escalate privileges, bypass authorization controls, or impersonate internal services via specially crafted GUI requests. The vulnerability has a low severity rating and a CVSS score of 3.8.
An out-of-bounds write vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw may allow an authenticated remote attacker with administrative privileges to execute unauthorized code or commands by sending a specially crafted request. The vulnerability affects versions from 7.2.4 through 8.0.1 across these products. The CVSS v3.1 base score is 7.2, indicating high severity with impacts on confidentiality, integrity, and availability.