Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126262 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Fortinet |
| Product | FortiAnalyzer, FortiManager |
| Vulnerability Type | SQL injection (CWE-89) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An improper neutralization of special elements used in an SQL command (‘SQL injection’) vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11 and 7.2.0 through 7.2.12, and FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11 and 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the OFTP port to execute code or commands on the system via crafted OFTP packets.
OFTP is the protocol FortiGate devices use to send logs to FortiAnalyzer. Compromising FortiAnalyzer or FortiManager gives an attacker visibility into the logs of the whole infrastructure and, in the case of FortiManager, control over the configuration of managed firewalls.
Required Actions
- Update FortiAnalyzer and FortiManager to the versions listed in Fortinet advisory FG-IR-26-276.
- Restrict access to the OFTP port (514/TCP by default) to log-sending devices only — it should not be reachable from the internet.
- Review FortiAnalyzer and FortiManager system logs for unknown devices, unusual OFTP connections and unexpected configuration changes.
Who Is Affected?
The vulnerability affects Fortinet FortiAnalyzer 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11 and 7.2.0–7.2.12, and FortiManager 8.0.0, 7.6.0–7.6.7, 7.4.0–7.4.11 and 7.2.0–7.2.12. FortiAnalyzer is used for central log collection and reporting, and FortiManager for central management of FortiGate firewalls — both are common in enterprises and at managed service providers.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126262 vulnerability?
CVE-2026-126262 is an SQL injection flaw (CWE-89) in Fortinet FortiAnalyzer and FortiManager that allows code or command execution via crafted OFTP packets. CVSS score: 9.8.
Does exploiting CVE-2026-126262 require authentication?
No. Network access to the OFTP port is enough; the attack requires no authentication or user interaction.
How to protect against CVE-2026-126262?
Update FortiAnalyzer and FortiManager as per advisory FG-IR-26-276 and restrict the OFTP port to log-sending devices.
Who is affected by CVE-2026-126262?
Organizations running FortiAnalyzer 7.2–8.0.1 or FortiManager 7.2–8.0.0 in the versions listed in the advisory.
