Fortinet FortiAnalyzer and FortiManager SQL Injection (CVE-2026-126213)
An authenticated SQL injection vulnerability in Fortinet FortiAnalyzer and FortiManager products allows an authenticated attacker to execute unauthorized SQL commands via specially crafted requests.
CVE search metadata
CVE search record: CVE-2026-126213. Severity: high. CVSS: 7.1. KEV: no. Product: FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud. Brief: Fortinet FortiAnalyzer and FortiManager SQL Injection (CVE-2026-126213). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-sql-injection-cve-2026-126213/
Triage facts
Revision 1- Applicability
- FortiAnalyzer, FortiAnalyzer Cloud +2
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:18 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability exists in various versions of Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud. This vulnerability allows an authenticated attacker to execute unauthorized SQL commands via specially crafted requests. The vulnerability is assigned a CVSS v3.1 base score of 7.1.
Impact
Successful exploitation may allow an authenticated attacker to execute unauthorized SQL commands.
Recommendation
Refer to the official Fortinet advisory regarding CVE-2026-126213 for guidance on affected versions and remediation steps.