Main Vulnerability Database Vulnerabilities #VU165271

Authentication Bypass by Spoofing in FortiManager and FortiAnalyzer - CVE-2026-126184

Published: November 11, 2026

Vulnerability identifier: #VU165271

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-126184

CWE-ID: CWE-290

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to damange or delete data.

The vulnerability exists due to authentication bypass by spoofing. An attacker can disrupt the HA state.

FortiManager
FortiAnalyzer

Install update from vendor's website.

FortiManager - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.2
FortiAnalyzer - addressed in versions 7.2.13, 7.4.12, 7.6.8, 8.0.2