Fortinet FortiAnalyzer and FortiManager: Format string vulnerability (CVE-2026-126171)
An authenticated attacker can exploit a format string vulnerability in specific versions of Fortinet FortiAnalyzer and FortiManager products to execute unauthorized commands via specially crafted HTTP requests.
CVE search metadata
CVE search record: CVE-2026-126171. Severity: high. CVSS: 7.2. KEV: no. Product: FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud. Brief: Fortinet FortiAnalyzer and FortiManager: Format string vulnerability (CVE-2026-126171). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortianalyzer-fortimanager-format-string-rce-cve-2026-126171/
Triage facts
Revision 1- Applicability
- FortiAnalyzer, FortiAnalyzer Cloud +2
- Evidence
- Not observed
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:16 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-126171 is a use of an externally-controlled format string vulnerability in Fortinet FortiAnalyzer and FortiManager. An authenticated attacker can exploit this vulnerability to execute unauthorized commands via specially crafted HTTP requests.
Impact
Successful exploitation allows an authenticated attacker to execute unauthorized commands on the affected device.
Recommendation
Review the vendor's documentation for the specific product versions identified as affected by CVE-2026-126171.