Fortinet FortiAnalyzer and FortiManager: Improper privilege management (CVE-2026-126211)
An improper privilege management vulnerability in Fortinet FortiAnalyzer and FortiManager allows an authenticated privileged attacker to escalate their permissions using crafted JSON-RPC requests.
CVE search metadata
CVE search record: CVE-2026-126211. Severity: high. CVSS: 7.2. KEV: no. Product: FortiAnalyzer (8.0.0 through 8.0.1), FortiAnalyzer (7.6.1 through 7.6.7), FortiAnalyzer Cloud (8.0.0 through 8.0.1), FortiAnalyzer Cloud (7.6.1 through 7.6.8), FortiManager (8.0.0 through 8.0.1), FortiManager (7.6.1 through 7.6.7), FortiManager Cloud (8.0.0 through 8.0.1), FortiManager Cloud (7.6.1 through 7.6.8). Brief: Fortinet FortiAnalyzer and FortiManager: Improper privilege management (CVE-2026-126211). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-privilege-elevation-cve-2026-126211/
Triage facts
Revision 1- Applicability
- FortiAnalyzer (8.0.0 through 8.0.1), FortiAnalyzer (7.6.1 through 7.6.7) +6
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:18 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Fortinet has disclosed an improper privilege management vulnerability (CVE-2026-126211) affecting multiple versions of FortiAnalyzer and FortiManager. The vulnerability allows an authenticated attacker who already possesses existing privileges to further escalate their permissions on the affected device. This is achieved by sending a crafted JSON-RPC request to the system.
Impact
Successful exploitation allows an authenticated attacker to elevate their privileges, potentially resulting in unauthorized administrative access and control over the affected FortiAnalyzer or FortiManager instance.
Recommendation
Inventory all instances of FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud to identify versions within the affected ranges. Monitor official Fortinet security advisories for the release of patched versions and apply updates to all identified affected assets immediately upon availability.
Immediate actions
Inventory affected FortiAnalyzer and FortiManager appliances and cloud instances.
Threat Hunt
Hunt for unusual or malformed JSON-RPC requests originating from internal administrative accounts.
Data: FortiAnalyzer/FortiManager system logs, API audit logs