Main Vulnerability Database Vulnerabilities #VU165204

SQL injection in FortiManager and FortiAnalyzer - CVE-2026-126213

Published: November 11, 2026

Vulnerability identifier: #VU165204

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-126213

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper neutralization of special elements used in an sql command ('sql injection'). An authenticated attacker can execute unauthorized SQL commands via specially crafted requests.

Affected software

FortiManager
FortiAnalyzer

How to mitigate CVE-2026-126213

Install update from vendor's website.

FortiManager - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.2
FortiAnalyzer - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.2

External References

https://www.fortiguard.com/psirt/FG-IR-26-233

Related Security Bulletins