FortiManager vulnerabilities

85 known vulnerabilities in FortiManager from Fortinet. 85 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  FortiAnalyzer: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-126262Nov 11, 2026Fortinet

  A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, Forti

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126236Nov 11, 2026FortinetEPSS 1.56%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12,

• 7.2 High severity

  FortiManager: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-126235Nov 11, 2026Fortinet

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.2 through 7.6.7, FortiAnalyzer 7.4.7 through 7.4.11, FortiAnalyzer 7.2.10 through 7.2.12, FortiAnaly

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2026-126234Nov 11, 2026Fortinet

  A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to exe

• 7.2 High severity

  FortiManager: Unrestricted Upload of File with Dangerous Type

  CVE-2026-126233Nov 11, 2026Fortinet

  A unrestricted upload of file with dangerous type vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, F

• 7.5 High severity

  FortiManager: Improper Certificate Validation

  CVE-2026-126232Nov 11, 2026Fortinet

  A improper certificate validation vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126231Nov 11, 2026FortinetEPSS 1.56%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Clo

• 7.2 High severity

  FortiManager: Use of Externally-Controlled Format String

  CVE-2026-126230Nov 11, 2026Fortinet

  A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiA

• 9.1 Critical severity

  FortiManager: Authorization Bypass Through User-Controlled Key

  CVE-2026-126229Nov 11, 2026Fortinet

  A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAnal

• 7.2 High severity

  FortiManager: Out-of-bounds Write

  CVE-2026-126228Nov 11, 2026Fortinet

  A out-of-bounds write vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.4 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 thr

• 7.2 High severity

  FortiManager: Unintended Proxy or Intermediary

  CVE-2026-126227Nov 11, 2026Fortinet

  A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnaly

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126226Nov 11, 2026Fortinet

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer

• 7.1 High severity

  FortiManager: Missing Authorization

  CVE-2026-126225Nov 11, 2026Fortinet

  A missing authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.7, FortiManager Cloud 8.0.0 through

• 7.2 High severity

  FortiManager: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-126224Nov 11, 2026Fortinet

  A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8

• 7.2 High severity

  FortiManager: Stack-based Buffer Overflow

  CVE-2026-126223Nov 11, 2026Fortinet

  A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cl

• 7.2 High severity

  FortiManager: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-126222Nov 11, 2026Fortinet

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.3 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.3 through 7.6.7, F

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-126221Nov 11, 2026Fortinet

  A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-126220Nov 11, 2026Fortinet

  A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to r

• 7.2 High severity

  FortiManager: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-126219Nov 11, 2026Fortinet

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through

• 8.2 High severity

  FortiManager: Authorization Bypass Through User-Controlled Key

  CVE-2026-126218Nov 11, 2026Fortinet

  A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow a remote authenticated attacker with admin permission to elevate their

• 8.7 High severity

  FortiManager: Incorrect Authorization

  CVE-2026-126217Nov 11, 2026Fortinet

  A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0

• 8.2 High severity

  FortiManager: Incorrect Authorization

  CVE-2026-126215Nov 11, 2026Fortinet

  A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0

• 7.2 High severity

  FortiManager: Authentication Bypass by Spoofing

  CVE-2026-126214Nov 11, 2026Fortinet

  A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer C

• 7.1 High severity

  FortiManager: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-126213Nov 11, 2026Fortinet

  A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, Forti

• 7.2 High severity

  FortiManager: Heap-based Buffer Overflow

  CVE-2026-126212Nov 11, 2026Fortinet

  A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Clo

• 7.2 High severity

  FortiManager: Improper Privilege Management

  CVE-2026-126211Nov 11, 2026Fortinet

  A improper privilege management vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.1 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.1 through 7.6.8, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6

• 7.2 High severity

  FortiManager: Improper Control of Generation of Code

  CVE-2026-126185Nov 11, 2026Fortinet

  A improper control of generation of code ('code injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 t

• 8.2 High severity

  FortiManager: Authentication Bypass by Spoofing

  CVE-2026-126184Nov 11, 2026Fortinet

  A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 thr

• 8.7 High severity

  FortiManager: Authorization Bypass Through User-Controlled Key

  CVE-2026-126183Nov 11, 2026Fortinet

  A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud

• 7.2 High severity

  FortiManager: Improper Control of Generation of Code

  CVE-2026-126182Nov 11, 2026Fortinet

  A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0

• 8.0 High severity

  FortiManager: Use of Hard-coded Credentials

  CVE-2026-126181Nov 11, 2026Fortinet

  A use of hard-coded credentials vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions may allow an adjacent-network authenticated attacker with user permis

• 8.4 High severity

  FortiManager: Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2026-126180Nov 11, 2026Fortinet

  A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 thr

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126179Nov 11, 2026FortinetEPSS 1.4%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer

• 7.2 High severity

  FortiManager: Heap-based Buffer Overflow

  CVE-2026-126178Nov 11, 2026Fortinet

  A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.

• 8.1 High severity

  FortiManager: XML Injection

  CVE-2026-126177Nov 11, 2026Fortinet

  A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7

• 8.1 High severity

  FortiManager: XML Injection

  CVE-2026-126176Nov 11, 2026Fortinet

  A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7

• 8.8 High severity

  FortiManager: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-126175Nov 11, 2026Fortinet

  A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.2 through 7.2.12, FortiAnalyzer Cloud 7.6.0 through 7.6.7,

• 7.2 High severity

  FortiManager: Use of Externally-Controlled Format String

  CVE-2026-126171Nov 11, 2026Fortinet

  A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud

• 9.8 Critical severity

  FortiManager: Improper Encoding or Escaping of Output

  CVE-2026-126170Nov 11, 2026Fortinet

  A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.

• 9.8 Critical severity

  FortiManager: Improper Authorization

  CVE-2026-126261Nov 10, 2026Fortinet

  A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or co