Main Vulnerability Database Vulnerabilities #VU165107

Arbitrary file upload in FortiManager and FortiAnalyzer - CVE-2026-126233

Published: November 11, 2026

Vulnerability identifier: #VU165107

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-126233

CWE-ID: CWE-434

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to unrestricted upload of file with dangerous type in httpd. An authenticated administrator can upload arbitrary files via specially crafted requests.

Affected software

FortiManager
FortiAnalyzer

How to mitigate CVE-2026-126233

Install update from vendor's website.

FortiManager - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.2
FortiAnalyzer - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.2

External References

https://www.fortiguard.com/psirt/FG-IR-26-248

Related Security Bulletins