Main Vulnerability Database Vulnerabilities #VU165162

SQL injection in FortiAnalyzer and FortiManager - CVE-2026-126262

Published: November 11, 2026

Vulnerability identifier: #VU165162

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-126262

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in an sql command ('sql injection'). An unauthenticated attacker who has access can the oftp port to execute code or command on the system via crafted OFTP packets.

Affected software

FortiAnalyzer
FortiManager

How to mitigate CVE-2026-126262

Install update from vendor's website.

FortiAnalyzer - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.2
FortiManager - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.1

External References

https://www.fortiguard.com/psirt/FG-IR-26-276

Related Security Bulletins