SB2026111148 - Multiple vulnerabilities in FortiAnalyzer and FortiManager

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111148

SB2026111148 - Multiple vulnerabilities in FortiAnalyzer and FortiManager

Published: November 11, 2026

Security Bulletin ID SB2026111148
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Incorrect authorization (CVE-ID: CVE-2026-126217)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to incorrect authorization. An authenticated administrator can escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.


2) Incorrect authorization (CVE-ID: CVE-2026-126216)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to incorrect authorization. An authenticated administrator can escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.


3) Incorrect authorization (CVE-ID: CVE-2026-126215)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to incorrect authorization. An authenticated administrator can escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.


4) Incorrect authorization (CVE-ID: CVE-2026-126214)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to incorrect authorization. An authenticated administrator can escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.


Remediation

Install update from vendor's website.

References