Fortinet FortiAnalyzer and FortiManager Path Traversal (CVE-2026-126222)
An authenticated administrator can exploit a path traversal vulnerability in Fortinet FortiAnalyzer and FortiManager products to achieve remote code execution via crafted requests.
CVE search metadata
CVE search record: CVE-2026-126222. KEV: no. Product: FortiAnalyzer (8.0.0-8.0.1, 7.6.3-7.6.7), FortiAnalyzer Cloud (8.0.0-8.0.1, 7.6.3-7.6.7), FortiManager (8.0.0-8.0.1, 7.6.3-7.6.7), FortiManager Cloud (8.0.0-8.0.1, 7.6.3-7.6.7). Brief: Fortinet FortiAnalyzer and FortiManager Path Traversal (CVE-2026-126222). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-path-traversal-cve-2026-126222/
Triage facts
Revision 1- Applicability
- FortiAnalyzer (8.0.0-8.0.1, 7.6.3-7.6.7), FortiAnalyzer Cloud (8.0.0-8.0.1, 7.6.3-7.6.7) +2
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:22 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-126222 is a path traversal vulnerability affecting multiple versions of Fortinet FortiAnalyzer and FortiManager appliances. An authenticated attacker with administrative privileges can leverage this flaw to execute unauthorized code or commands on the underlying system by submitting crafted requests. The vulnerability affects both on-premise and cloud-hosted instances of these products.
Impact
Successful exploitation allows an authenticated administrator to execute arbitrary code or commands on the affected appliance. This could lead to full system compromise, data theft, or persistence within the management infrastructure.
Recommendation
Identify all instances of Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud within the environment. Consult the official Fortinet PSIRT advisory to confirm the specific patch releases for the impacted versions and apply the necessary firmware updates immediately.
Immediate actions
Inventory all FortiAnalyzer and FortiManager deployments for versions listed as vulnerable
Threat Hunt
Monitor administrative session logs for anomalous or malformed requests originating from known administrator accounts.
Data: FortiAnalyzer/FortiManager WebUI access logs, Management API request logs