Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126229 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiAnalyzer, FortiManager (także Cloud) |
| Vulnerability Type | authorization bypass through user-controlled key (CWE-639) |
| CVSS Score | 9.1 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11 and 7.2 all versions, FortiAnalyzer Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11 and 7.2 all versions, FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11 and 7.2 all versions, and FortiManager Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11 and 7.2 all versions may allow an authenticated administrator to access other VDOMs via specially crafted HTTP requests.
VDOMs (virtual domains) separate the data and configuration of individual business units, branches or customers. The flaw breaks this isolation — it mostly affects multi-tenant environments, such as managed service providers, where an administrator of one customer could reach another customer’s data. The attack requires an administrator account (PR:H).
Required Actions
- Update FortiAnalyzer and FortiManager (and check the version of Cloud instances) as per Fortinet advisory FG-IR-26-244.
- Review administrator accounts assigned to individual VDOMs and remove unnecessary ones.
- Until patched, monitor audit logs for administrators accessing VDOMs outside their assignment.
Who Is Affected?
The vulnerability affects Fortinet FortiAnalyzer and FortiManager 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11 and all 7.2 versions, and their Cloud variants (8.0.1, 7.6.0–7.6.7, 7.4.1–7.4.11, all 7.2). The risk is highest in deployments with multiple VDOMs and administrators. FortiAnalyzer is used for central log collection and reporting, and FortiManager for central management of FortiGate firewalls — both are common in enterprises and at managed service providers.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126229 vulnerability?
CVE-2026-126229 is an authorization bypass through user-controlled key flaw (CWE-639) in Fortinet FortiAnalyzer and FortiManager that allows an administrator to access other VDOMs. CVSS score: 9.1.
Does exploiting CVE-2026-126229 require authentication?
Yes. The attacker needs an administrator account (scoped to selected VDOMs); the flaw allows them to exceed that scope.
How to protect against CVE-2026-126229?
Update FortiAnalyzer and FortiManager as per advisory FG-IR-26-244 and minimize the number of administrator accounts.
Who is affected by CVE-2026-126229?
Organizations and managed service providers running FortiAnalyzer or FortiManager 7.2–8.0.1 (including Cloud) with multiple VDOMs.
