Fortinet FortiAnalyzer and FortiManager: Path traversal vulnerability (CVE-2026-126219)
CVE-2026-126219 is a path traversal vulnerability in Fortinet FortiAnalyzer and FortiManager that allows an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted GUI requests.
CVE search metadata
CVE search record: CVE-2026-126219. Severity: high. CVSS: 7.2. KEV: no. Product: FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11. Brief: Fortinet FortiAnalyzer and FortiManager: Path traversal vulnerability (CVE-2026-126219). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-126219/
Triage facts
Revision 1- Applicability
- FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7 +10
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:22 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-126219 is an improper limitation of a pathname to a restricted directory (path traversal) vulnerability affecting multiple versions of Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud. An authenticated administrator may leverage this vulnerability to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.
Impact
Successful exploitation allows an authenticated administrator to interact with the underlying filesystem and execute unauthorized commands or code. The CVSS v3.1 Base Score is 7.2.