Fortinet FortiAnalyzer and FortiManager: OS command injection (CVE-2026-126179)
An OS command injection vulnerability in Fortinet FortiAnalyzer and FortiManager allows an authenticated administrator to execute unauthorized code or commands via specially crafted requests.
CVE search metadata
CVE search record: CVE-2026-126179. Severity: high. CVSS: 7.2. KEV: no. Product: FortiAnalyzer (8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12), FortiAnalyzer Cloud (8.0.0, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12), FortiManager (8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12), FortiManager Cloud (8.0.0, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12). Brief: Fortinet FortiAnalyzer and FortiManager: OS command injection (CVE-2026-126179). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-cve-2026-126179/
Triage facts
Revision 1- Applicability
- FortiAnalyzer (8.0.0, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12), FortiAnalyzer Cloud (8.0.0, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2.1-7.2.12) +2
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:17 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
CVE-2026-126179 is an OS command injection vulnerability caused by improper neutralization of special elements in OS commands within several Fortinet products. The vulnerability permits an authenticated administrator to execute unauthorized code or commands through specially crafted requests. As of the current disclosure, there is no information indicating exploitation in the wild, though the vulnerability has a CVSS v3.1 base score of 7.2.
Impact
Successful exploitation allows an authenticated administrator to execute arbitrary code or commands on the affected system, potentially leading to full system compromise depending on the privileges of the administrator account involved.
Recommendation
Inventory all instances of FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud within the environment, specifically identifying versions within the affected ranges listed in this brief. Monitor for any administrative sessions or requests involving unusual characters or command-line patterns until updates are applied.
Immediate actions
Inventory affected FortiAnalyzer and FortiManager appliances against the version ranges provided.
Threat Hunt
Hunt for administrative requests containing suspicious shell metacharacters or command injection patterns in FortiAnalyzer/FortiManager access logs.
Data: FortiAnalyzer/FortiManager administrative web access logs