CVE-2026-126170 A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7...
CriticalCVSS 9.8
- Published
- Updated
- Exploit status
- No public exploit known
Description
A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortimanager | >= 8.0.0, <= 8.0.2 | No fix listed |
| fortinet fortimanager | >= 7.6.0, <= 7.6.7 | No fix listed |
| fortinet fortianalyzer | >= 8.0.0, <= 8.0.2 | No fix listed |
| fortinet fortianalyzer | >= 7.6.0, <= 7.6.7 | No fix listed |
| fortinet fortimanagercloud | >= 8.0.1, <= 8.0.2 | No fix listed |
| fortinet fortimanagercloud | >= 7.6.0, <= 7.6.7 | No fix listed |
| fortinet fortianalyzercloud | >= 8.0.1, <= 8.0.2 | No fix listed |
| fortinet fortianalyzercloud | >= 7.6.0, <= 7.6.7 | No fix listed |
| fortinet fortianalyzer-bigdata | >= 7.6.0, <= 7.6.2 | No fix listed |