Authorization Bypass in Fortinet FortiAnalyzer and FortiManager Products
CVE-2026-126229

9.1CRITICAL

Key Information:

Vendor

Fortinet
Status
Fortimanager
Fortianalyzer
Fortimanager Cloud
Fortianalyzer Cloud
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126229?

An authorization bypass vulnerability exists in Fortinet's FortiAnalyzer and FortiManager products. This flaw allows authenticated administrators to access other Virtual Domains (VDOMs) through specially crafted HTTP requests. The issue affects multiple versions of FortiAnalyzer and FortiManager, raising concerns about unauthorized access and potential data breaches. Organizations using these affected products should apply necessary patches and configurations to mitigate the risk associated with this vulnerability. For further details, refer to the official Fortinet advisory.

Affected Version(s)

FortiAnalyzer 8.0.0 <= 8.0.1

FortiAnalyzer 7.6.0 <= 7.6.7

FortiAnalyzer 7.4.0 <= 7.4.11

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-244

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.