Incorrect authorization in FortiManager and FortiAnalyzer - CVE-2026-126217
Published: November 11, 2026
Vulnerability identifier: #VU165171
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126217
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to read and manipulate data.
The vulnerability exists due to incorrect authorization. An authenticated administrator can escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.
Affected software
FortiManager
FortiAnalyzer
FortiAnalyzer
How to mitigate CVE-2026-126217
Install update from vendor's website.
FortiManager - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.2
FortiAnalyzer - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.2
FortiAnalyzer - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.2