CVE-2026-126225
Received
Received - Intake
Missing Authorization in Fortinet FortiAnalyzer and FortiManager
Vulnerability report for CVE-2026-126225, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Fortinet, Inc.
Description
Description
A missing authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.7 may allow an authenticated attacker to elevate their privileges via crafted JSON-RPC request.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Fortinet | FortiManager | From 8.0.0 (inc) to 8.0.1 (inc) |
| Fortinet | FortiManager | 7.6.7 |
| Fortinet | FortiAnalyzer | From 8.0.0 (inc) to 8.0.1 (inc) |
| Fortinet | FortiAnalyzer | 7.6.7 |
| Fortinet | FortiManager Cloud | From 8.0.0 (inc) to 8.0.1 (inc) |
| Fortinet | FortiManager Cloud | 7.6.7 |
| Fortinet | FortiAnalyzer Cloud | From 8.0.0 (inc) to 8.0.1 (inc) |
| Fortinet | FortiAnalyzer Cloud | 7.6.7 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
