Fortinet FortiAnalyzer and FortiManager: Heap-based Buffer Overflow (CVE-2026-126212)
An authenticated administrator can execute unauthorized code or commands or cause a denial of service on certain Fortinet products via specially crafted JSON-RPC requests.
CVE search metadata
CVE search record: CVE-2026-126212. Severity: high. CVSS: 7.2. KEV: no. Product: FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud. Brief: Fortinet FortiAnalyzer and FortiManager: Heap-based Buffer Overflow (CVE-2026-126212). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-buffer-overflow-cve-2026-126212/
Triage facts
Revision 1- Applicability
- FortiAnalyzer, FortiAnalyzer Cloud +2
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:18 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A heap-based buffer overflow vulnerability (CVE-2026-126212) exists in various versions of Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud. This vulnerability allows an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests. The CVSS v3.1 base score is 7.2.
Impact
Successful exploitation allows an authenticated administrator to execute unauthorized code or commands on the device or trigger a denial-of-service condition.