Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126170 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiAnalyzer, FortiManager (także Cloud i BigData) |
| Vulnerability Type | improper encoding or escaping of output (CWE-116) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2 and 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2 and 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2 and 7.6.0 through 7.6.7, and FortiManager Cloud 8.0.1 through 8.0.2 and 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request.
The attack goes through the device HTTP/HTTPS interface, so instances whose administrative interface is reachable from the internet or from broad internal network segments are particularly exposed.
Required Actions
- Update FortiAnalyzer, FortiManager and their Cloud/BigData variants to the versions listed in Fortinet advisory FG-IR-26-219 (Cloud instances are updated by the vendor — check their version in the console).
- Restrict access to the administrative interface (HTTP/HTTPS) to a dedicated management network or a list of trusted addresses.
- Review logs for unusual HTTP requests, new administrator accounts and unexpected configuration changes.
Who Is Affected?
The vulnerability affects Fortinet FortiAnalyzer 8.0.0–8.0.2 and 7.6.0–7.6.7, FortiAnalyzer Cloud 8.0.1–8.0.2 and 7.6.0–7.6.7, FortiAnalyzer-BigData 7.6.0–7.6.2, FortiManager 8.0.0–8.0.2 and 7.6.0–7.6.7, and FortiManager Cloud 8.0.1–8.0.2 and 7.6.0–7.6.7. FortiAnalyzer is used for central log collection and reporting, and FortiManager for central management of FortiGate firewalls — both are common in enterprises and at managed service providers.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126170 vulnerability?
CVE-2026-126170 is an improper encoding or escaping of output flaw (CWE-116) in Fortinet FortiAnalyzer and FortiManager that allows code or command execution via a crafted HTTP request. CVSS score: 9.8.
Does exploiting CVE-2026-126170 require authentication?
No. Network access to the device HTTP/HTTPS interface is enough; the attack requires no authentication or user interaction.
How to protect against CVE-2026-126170?
Update FortiAnalyzer and FortiManager as per advisory FG-IR-26-219 and restrict the administrative interface to the management network.
Who is affected by CVE-2026-126170?
Organizations running FortiAnalyzer or FortiManager 7.6–8.0.2, including Cloud versions and FortiAnalyzer-BigData 7.6.0–7.6.2.
