CVE-2026-126184
Received
Received - Intake
Authentication Bypass by Spoofing in Fortinet FortiAnalyzer and FortiManager
Vulnerability report for CVE-2026-126184, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Fortinet, Inc.
Description
Description
A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an attacker to disrupt the HA state.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Fortinet | FortiManager | From 8.0.0 (inc) to 8.0.1 (inc) |
| Fortinet | FortiManager | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiManager | From 7.4.0 (inc) to 7.4.11 (inc) |
| Fortinet | FortiManager | From 7.2.0 (inc) to 7.2.12 (inc) |
| Fortinet | FortiManager Cloud | 8.0.1 |
| Fortinet | FortiManager Cloud | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiManager Cloud | From 7.4.1 (inc) to 7.4.11 (inc) |
| Fortinet | FortiManager Cloud | From 7.2.1 (inc) to 7.2.12 (inc) |
| Fortinet | FortiAnalyzer | From 8.0.0 (inc) to 8.0.1 (inc) |
| Fortinet | FortiAnalyzer | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiAnalyzer | From 7.4.0 (inc) to 7.4.11 (inc) |
| Fortinet | FortiAnalyzer | From 7.2.0 (inc) to 7.2.12 (inc) |
| Fortinet | FortiAnalyzer Cloud | 8.0.1 |
| Fortinet | FortiAnalyzer Cloud | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiAnalyzer Cloud | From 7.4.1 (inc) to 7.4.11 (inc) |
| Fortinet | FortiAnalyzer Cloud | From 7.2.1 (inc) to 7.2.12 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-290 | This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
