Missing Authorization Vulnerability in Fortinet FortiAnalyzer and FortiManager Products
CVE-2026-126225

7.1HIGH

Key Information:

Vendor

Fortinet
Status
Fortimanager
Fortianalyzer
Fortimanager Cloud
Fortianalyzer Cloud
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126225?

A vulnerability exists within Fortinet's FortiAnalyzer and FortiManager line of products that improperly handles authorization. This flaw allows an authenticated attacker to elevate their privileges by sending specially crafted JSON-RPC requests. Affected versions include multiple releases of FortiAnalyzer and FortiManager software, both on-premise and cloud-based solutions. Organizations using these versions should assess their security posture and implement necessary mitigations to safeguard against potential exploitation.

Affected Version(s)

FortiAnalyzer 8.0.0 <= 8.0.1

FortiAnalyzer 7.6.7

FortiAnalyzer Cloud 8.0.0 <= 8.0.1

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-240

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.