Privilege Escalation in Fortinet FortiAnalyzer and FortiManager Products
CVE-2026-126215

8.2HIGH

Key Information:

Vendor

Fortinet
Status
Fortimanager
Fortianalyzer
Fortimanager Cloud
Fortianalyzer Cloud
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126215?

Fortinet FortiAnalyzer and FortiManager products exhibit a vulnerability that may allow an authenticated administrator to leverage incorrect authorization mechanisms. This can lead to privilege escalation, giving unauthorized users access to sensitive functionalities or the ability to impersonate internal services by sending specially crafted requests through the graphical user interface. Multiple versions of FortiAnalyzer and FortiManager, as well as their cloud counterparts, are impacted, necessitating immediate attention and mitigation to protect against potential attacks.

Affected Version(s)

FortiAnalyzer 8.0.0 <= 8.0.1

FortiAnalyzer 7.6.0 <= 7.6.7

FortiAnalyzer 7.4.0 <= 7.4.11

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-234

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.