Main Vulnerability Database Vulnerabilities #VU165273

Code Injection in FortiManager and FortiAnalyzer - CVE-2026-126185

Published: November 11, 2026

Vulnerability identifier: #VU165273

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-126185

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper control of generation of code ('code injection'). An authenticated administrator can execute unauthorized code or commands via specially crafted requests.

Affected software

FortiManager
FortiAnalyzer

How to mitigate CVE-2026-126185

Install update from vendor's website.

FortiManager - addressed in versions 7.4.12, 7.6.8, 8.0.2
FortiAnalyzer - addressed in versions 7.4.12, 7.6.8, 8.0.2

External References

https://www.fortiguard.com/psirt/FG-IR-26-230

Related Security Bulletins