CVE-2026-126170
Received
Received - Intake
Cross-Site Scripting in Fortinet FortiAnalyzer and FortiManager
Vulnerability report for CVE-2026-126170, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Fortinet, Inc.
Description
Description
A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Fortinet | FortiManager | From 8.0.0 (inc) to 8.0.2 (inc) |
| Fortinet | FortiManager | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiAnalyzer | From 8.0.0 (inc) to 8.0.2 (inc) |
| Fortinet | FortiAnalyzer | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiManager Cloud | From 8.0.1 (inc) to 8.0.2 (inc) |
| Fortinet | FortiManager Cloud | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiAnalyzer Cloud | From 8.0.1 (inc) to 8.0.2 (inc) |
| Fortinet | FortiAnalyzer Cloud | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiAnalyzer-BigData | From 7.6.0 (inc) to 7.6.2 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
