SB2026111181 - Multiple vulnerabilities in FortiAnalyzer and FortiManager

Description

This security bulletin contains information about 3 vulnerabilities.

1) Path traversal (CVE-ID: CVE-2026-126221)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper limitation of a pathname to a restricted directory ('path traversal'). An authenticated administrator can read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.

2) Path traversal (CVE-ID: CVE-2026-126220)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper limitation of a pathname to a restricted directory ('path traversal'). An authenticated administrator can read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.

3) Path traversal (CVE-ID: CVE-2026-126219)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper limitation of a pathname to a restricted directory ('path traversal'). An authenticated administrator can read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.

Remediation

Install update from vendor's website.

References

• https://www.fortiguard.com/psirt/FG-IR-26-236