Main Vulnerability Database Vulnerabilities #VU165205

OS Command Injection in FortiManager and FortiAnalyzer - CVE-2026-126226

Published: November 11, 2026

Vulnerability identifier: #VU165205

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-126226

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in an os command ('os command injection'). An authenticated privileged attacker can execute unauthorized code or commands via crafted report schedule name.

Affected software

FortiManager
FortiAnalyzer

How to mitigate CVE-2026-126226

Install update from vendor's website.

FortiManager - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.1
FortiAnalyzer - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.2

External References

https://www.fortiguard.com/psirt/FG-IR-26-241

Related Security Bulletins