FortiManager Cloud vulnerabilities

59 known vulnerabilities in FortiManager Cloud from Fortinet. 59 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126236Nov 11, 2026FortinetEPSS 1.56%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12,

• 7.2 High severity

  FortiManager: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-126235Nov 11, 2026Fortinet

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.2 through 7.6.7, FortiAnalyzer 7.4.7 through 7.4.11, FortiAnalyzer 7.2.10 through 7.2.12, FortiAnaly

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2026-126234Nov 11, 2026Fortinet

  A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to exe

• 7.2 High severity

  FortiManager: Unrestricted Upload of File with Dangerous Type

  CVE-2026-126233Nov 11, 2026Fortinet

  A unrestricted upload of file with dangerous type vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, F

• 7.5 High severity

  FortiManager: Improper Certificate Validation

  CVE-2026-126232Nov 11, 2026Fortinet

  A improper certificate validation vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126231Nov 11, 2026FortinetEPSS 1.56%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Clo

• 7.2 High severity

  FortiManager: Use of Externally-Controlled Format String

  CVE-2026-126230Nov 11, 2026Fortinet

  A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiA

• 9.1 Critical severity

  FortiManager: Authorization Bypass Through User-Controlled Key

  CVE-2026-126229Nov 11, 2026Fortinet

  A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAnal

• 7.2 High severity

  FortiManager: Out-of-bounds Write

  CVE-2026-126228Nov 11, 2026Fortinet

  A out-of-bounds write vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.4 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 thr

• 7.2 High severity

  FortiManager: Unintended Proxy or Intermediary

  CVE-2026-126227Nov 11, 2026Fortinet

  A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnaly

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126226Nov 11, 2026Fortinet

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer

• 7.1 High severity

  FortiManager: Missing Authorization

  CVE-2026-126225Nov 11, 2026Fortinet

  A missing authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.7, FortiManager Cloud 8.0.0 through

• 7.2 High severity

  FortiManager: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-126224Nov 11, 2026Fortinet

  A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8

• 7.2 High severity

  FortiManager: Stack-based Buffer Overflow

  CVE-2026-126223Nov 11, 2026Fortinet

  A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cl

• 7.2 High severity

  FortiManager: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-126222Nov 11, 2026Fortinet

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.3 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.3 through 7.6.7, F

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-126221Nov 11, 2026Fortinet

  A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer

• 7.2 High severity

  FortiManager: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-126219Nov 11, 2026Fortinet

  A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through

• 8.7 High severity

  FortiManager: Incorrect Authorization

  CVE-2026-126217Nov 11, 2026Fortinet

  A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0

• 8.2 High severity

  FortiManager: Incorrect Authorization

  CVE-2026-126215Nov 11, 2026Fortinet

  A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0

• 7.1 High severity

  FortiManager: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-126213Nov 11, 2026Fortinet

  A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, Forti

• 7.2 High severity

  FortiManager: Heap-based Buffer Overflow

  CVE-2026-126212Nov 11, 2026Fortinet

  A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Clo

• 7.2 High severity

  FortiManager: Improper Privilege Management

  CVE-2026-126211Nov 11, 2026Fortinet

  A improper privilege management vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.1 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.1 through 7.6.8, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6

• 7.2 High severity

  FortiManager: Improper Control of Generation of Code

  CVE-2026-126185Nov 11, 2026Fortinet

  A improper control of generation of code ('code injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 t

• 8.2 High severity

  FortiManager: Authentication Bypass by Spoofing

  CVE-2026-126184Nov 11, 2026Fortinet

  A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 thr

• 8.7 High severity

  FortiManager: Authorization Bypass Through User-Controlled Key

  CVE-2026-126183Nov 11, 2026Fortinet

  A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud

• 7.2 High severity

  FortiManager: Improper Control of Generation of Code

  CVE-2026-126182Nov 11, 2026Fortinet

  A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0

• 8.4 High severity

  FortiManager: Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2026-126180Nov 11, 2026Fortinet

  A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 thr

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-126179Nov 11, 2026FortinetEPSS 1.4%

  A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer

• 7.2 High severity

  FortiManager: Heap-based Buffer Overflow

  CVE-2026-126178Nov 11, 2026Fortinet

  A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.

• 8.1 High severity

  FortiManager: XML Injection

  CVE-2026-126177Nov 11, 2026Fortinet

  A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7

• 8.1 High severity

  FortiManager: XML Injection

  CVE-2026-126176Nov 11, 2026Fortinet

  A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7

• 8.8 High severity

  FortiManager: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-126175Nov 11, 2026Fortinet

  A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.2 through 7.2.12, FortiAnalyzer Cloud 7.6.0 through 7.6.7,

• 7.2 High severity

  FortiManager: Use of Externally-Controlled Format String

  CVE-2026-126171Nov 11, 2026Fortinet

  A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud

• 9.8 Critical severity

  FortiManager: Improper Encoding or Escaping of Output

  CVE-2026-126170Nov 11, 2026Fortinet

  A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.

• 8.1 High severity

  FortiManager: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-61625Nov 10, 2026Fortinet

  An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager

• 7.2 High severity

  FortiManager Cloud: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-23707Oct 13, 2026Fortinet

  An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7

• 8.1 High severity

  FortiManager: Authentication Bypass Using an Alternate Path or Channel

  CVE-2026-70468Aug 12, 2026Fortinet

  A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1, FortiManager Cloud 7.4.3 through 7.4.5, FortiManager Cloud 7.

• 8.1 High severity

  FortiAnalyzer Cloud: Heap-based Buffer Overflow

  CVE-2026-22828Apr 14, 2026Fortinet

  A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2 through 7.6.4 may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Successf

• 7.2 High severity

  FortiManager: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-61848Apr 14, 2026Fortinet

  An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyze

• 7.2 High severity

  FortiAnalyzer: Authentication Bypass Using an Alternate Path or Channel

  CVE-2026-22572Mar 10, 2026Fortinet

  An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.2 through 7.2.12, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7,