Paper/Archive/CVE-2026-126170

CVE-2026-126170

Fortinet FortiManager — A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7,…

CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request

Affected

ProductAffectedFixed inSource

FortiManager8.0.0 – 8.0.2–CNA

FortiManager7.6.0 – 7.6.7–CNA

FortiAnalyzer8.0.0 – 8.0.2–CNA

FortiAnalyzer7.6.0 – 7.6.7–CNA

FortiManager Cloud8.0.1 – 8.0.2–CNA

FortiManager Cloud7.6.0 – 7.6.7–CNA

FortiAnalyzer Cloud8.0.1 – 8.0.2–CNA

FortiAnalyzer Cloud7.6.0 – 7.6.7–CNA

FortiAnalyzer-BigData7.6.0 – 7.6.2–CNA

Scores by source

fortinet (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:R

References

reffortiguard.fortinet.com/psirt/FG-IR-26-219