CVE-2026-126228
Received
Received - Intake
Out-of-Bounds Write in Fortinet FortiAnalyzer and FortiManager
Vulnerability report for CVE-2026-126228, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-11
Last updated on: 2026-11-11
Assigner: Fortinet, Inc.
Description
Description
A out-of-bounds write vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.4 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.4 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.4 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.4 through 7.2.12 may allow an authenticated remote attacker with admin privileges to execute unauthorized code or commands via a specially crafted request.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Fortinet | FortiManager | From 8.0.0 (inc) to 8.0.1 (inc) |
| Fortinet | FortiManager | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiManager | From 7.4.0 (inc) to 7.4.11 (inc) |
| Fortinet | FortiManager | From 7.2.4 (inc) to 7.2.12 (inc) |
| Fortinet | FortiAnalyzer | From 8.0.0 (inc) to 8.0.1 (inc) |
| Fortinet | FortiAnalyzer | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiAnalyzer | From 7.4.0 (inc) to 7.4.11 (inc) |
| Fortinet | FortiAnalyzer | From 7.2.4 (inc) to 7.2.12 (inc) |
| Fortinet | FortiManager Cloud | From 8.0.0 (inc) to 8.0.1 (inc) |
| Fortinet | FortiManager Cloud | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiManager Cloud | From 7.4.1 (inc) to 7.4.11 (inc) |
| Fortinet | FortiManager Cloud | From 7.2.4 (inc) to 7.2.12 (inc) |
| Fortinet | FortiAnalyzer Cloud | From 8.0.0 (inc) to 8.0.1 (inc) |
| Fortinet | FortiAnalyzer Cloud | From 7.6.0 (inc) to 7.6.7 (inc) |
| Fortinet | FortiAnalyzer Cloud | From 7.4.1 (inc) to 7.4.11 (inc) |
| Fortinet | FortiAnalyzer Cloud | From 7.2.4 (inc) to 7.2.12 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
