An authentication bypass vulnerability exists in Fortinet FortiAnalyzer and FortiManager products across multiple versions. This flaw allows an authenticated administrator to escalate privileges, bypass authorization controls, or impersonate internal services via specially crafted GUI requests. The vulnerability affects both on-premises and cloud versions of FortiAnalyzer and FortiManager. It has a high severity rating with a CVSS score of 7.2. No public exploits or patches are currently documented in the provided data.
An unintended proxy or intermediary ('confused deputy') vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This vulnerability may allow an authenticated attacker to execute commands outside the intended scope by sending specially crafted HTTP requests. The affected versions span several major releases of FortiAnalyzer and FortiManager. The vulnerability has a high severity rating with a CVSS score of 7.2, indicating significant potential impact on confidentiality, integrity, and availability.
An incorrect authorization vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their Cloud variants. This flaw allows an authenticated administrator to escalate privileges, bypass authorization controls, or impersonate internal services through specially crafted GUI requests. The vulnerability affects versions 7.2.x through 8.0.1 across these products. It has a high severity with a CVSS score of 8.2.
An SQL injection vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated attacker to execute unauthorized SQL commands via specially crafted requests. The vulnerability affects FortiAnalyzer versions 7.2 all versions through 8.0.1 and FortiManager versions 7.2.0 through 8.0.1, including cloud versions in similar ranges. The CVSS score is 7.1, indicating a high severity impact primarily on confidentiality. No public exploits or patches are currently documented.
An argument injection vulnerability (CWE-88) exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated privileged administrator to execute unauthorized commands or code due to improper neutralization of argument delimiters in commands.
A missing authorization vulnerability exists in Fortinet FortiAnalyzer and FortiManager products including certain cloud versions. This flaw affects FortiAnalyzer versions 8.0.0 through 8.0.1 and 7.6.7, FortiAnalyzer Cloud versions 8.0.0 through 8.0.1 and 7.6.7, FortiManager versions 8.0.0 through 8.0.1 and 7.6.7, and FortiManager Cloud versions 8.0.0 through 8.0.1 and 7.6.7. An authenticated attacker may exploit this vulnerability by sending a crafted JSON-RPC request to elevate their privileges. The vulnerability is tracked as CVE-2026-126225 and has a CVSS v3.1 base score of 7.1, indicating high severity.
A vulnerability in Fortinet FortiManager versions 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0 through 8.0.1 allows a remote authenticated attacker with admin privileges to escalate their access to root by exploiting an authorization bypass via user-controlled keys in crafted HTTP requests.
A path traversal vulnerability exists in Fortinet FortiAnalyzer and FortiManager products, including their cloud versions, across multiple 7.6.x and 8.0.x releases. This flaw allows an authenticated attacker with administrative privileges to execute unauthorized code or commands by sending crafted requests. The vulnerability affects versions FortiAnalyzer 7.6.3 through 7.6.7 and 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.3 through 7.6.7 and 8.0.0 through 8.0.1, FortiManager 7.6.3 through 7.6.7 and 8.0.0 through 8.0.1, and FortiManager Cloud 7.6.3 through 7.6.7 and 8.0.0 through 8.0.1. The CVSS v3.1 base score is 7.2, indicating a high severity vulnerability. No public exploits or patches are currently documented in the provided data.
An injection vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI. The vulnerability affects FortiAnalyzer versions 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0; FortiManager versions 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, and 8.0.0; and their respective cloud versions. The CVSS v3.1 base score is 7.2, indicating a high severity impact. No public exploits or patches are currently documented in the provided data.
A heap-based buffer overflow vulnerability exists in multiple versions of Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud. This flaw may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests.
An OS command injection vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw allows an authenticated administrator to execute unauthorized code or commands via specially crafted requests. The vulnerability affects versions 7.2.x through 8.0.0 of these products. It has a high severity rating with a CVSS score of 7.2.
An improper privilege management vulnerability exists in Fortinet FortiAnalyzer and FortiManager products, including their Cloud versions, across multiple 7.6.x and 8.0.x releases. This flaw allows an authenticated attacker with privileged access to elevate their privileges further by sending a crafted JSON-RPC request. The vulnerability has a high severity rating with a CVSS score of 7.2, indicating significant potential impact on confidentiality, integrity, and availability.
An improper encoding or escaping of output vulnerability exists in multiple versions of Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiManager, and FortiManager Cloud. This flaw may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request. The vulnerability affects versions 7.6.0 through 7.6.7 and 8.0.0 through 8.0.2 of these products. It has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
Fortinet FortiMail versions 8.0.0 through 8.0.1 contain a use of externally-controlled format string vulnerability. This flaw may allow a remote unauthenticated attacker to execute unauthorized code or commands by sending a specially crafted SMTP command to the affected system.
An XML injection vulnerability, also known as blind XPath injection, exists in Fortinet FortiMail versions 7.6.0 through 7.6.6 and 8.0.0 through 8.0.1. This flaw may allow a remote unauthenticated attacker to execute unauthorized code or commands by sending a specially crafted request. The vulnerability has a high severity rating with a CVSS score of 8.7.
An XML injection vulnerability, also known as blind XPath injection, affects multiple versions of Fortinet FortiAnalyzer and FortiManager products including their cloud variants. This flaw allows an unauthenticated remote attacker to inject arbitrary content into a signed SAML response by sending crafted SAML requests. The vulnerability impacts versions 7.2.0 through 8.0.0 across these products. The CVSS score is 8.1, indicating a high severity issue with potential confidentiality, integrity, and availability impacts.
An improper control of code generation vulnerability (code injection) exists in Fortinet FortiAnalyzer and FortiManager products, including their cloud versions, across multiple 7.4.x, 7.6.x, and 8.0.x releases. This flaw allows an authenticated administrator to execute unauthorized code or commands via specially crafted requests.
An improper neutralization of special elements vulnerability exists in Fortinet FortiManager versions 7.2 all versions through 8.0.1 and corresponding FortiManager Cloud versions. This flaw may allow a low privileged Device Manager administrator to escalate privileges to super admin on managed FortiGate devices by injecting malicious commands.
CVE-2026-126167 is a command injection vulnerability in Fortinet FortiMail versions 7.2 all versions, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.2. It allows an authenticated remote attacker with domain admin or admin privileges to execute arbitrary commands as root, delete users of other tenant domains on a paired FortiAuthenticator, and read or write arbitrary files via crafted HTTP requests to the administrative interface.
CVE-2026-126169 is a vulnerability in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.2. It involves improper neutralization of argument delimiters in commands, allowing an authenticated remote attacker with domain admin or admin privileges to perform unauthorized actions on a paired FortiAuthenticator device. These actions include deleting users from other tenant domains, executing arbitrary code as root, running arbitrary CLI commands, and reading or writing arbitrary files via crafted HTTP requests to the administrative interface.