Fortinet FortiManager and FortiAnalyzer output encoding flaw lets unauthenticated attackers run code (CVE-2026-126170)

What happened

The CVE record describes an improper encoding or escaping of output vulnerability in several FortiManager and FortiAnalyzer products. An unauthenticated attacker can execute unauthorized code or commands by sending a specially crafted HTTP request.

Because the attack vector is network-based and requires no privileges or user interaction, any affected system reachable over the network should be treated as exposed. The CVE record rates the issue critical with a CVSS 3.1 score of 9.8 and high impact on confidentiality, integrity and availability.

The CVE record does not state that exploitation has occurred.

Who is affected

The CVE record lists the following affected products and versions:

• FortiManager 8.0.0 to 8.0.2 and 7.6.0 to 7.6.7
• FortiAnalyzer 8.0.0 to 8.0.2 and 7.6.0 to 7.6.7
• FortiManager Cloud 8.0.1 to 8.0.2 and 7.6.0 to 7.6.7
• FortiAnalyzer Cloud 8.0.1 to 8.0.2 and 7.6.0 to 7.6.7
• FortiAnalyzer-BigData 7.6.0 to 7.6.2

If you run any of these versions, review them now. FortiManager and FortiAnalyzer are typically central management and analytics products, so an internet-facing instance represents a high-value target.

What to do now

1. Confirm whether you run any affected FortiManager, FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud or FortiAnalyzer-BigData version.
2. No fixed release is listed in the CVE record. Until one is published, restrict administrative access to trusted management networks only and do not expose these systems to the internet.
3. Monitor Fortinet's advisory for a fixed version, and apply it when available.
4. Review access logs for unexpected or malformed HTTP requests to the affected systems, since the attack path requires a specially crafted HTTP request and no credentials.

How to detect it

No indicators of compromise are listed in the CVE record. The attack path is an unauthenticated HTTP request to the affected product, so first confirm whether FortiManager or FortiAnalyzer interfaces are reachable from untrusted networks. Review access logs for unexpected or malformed HTTP requests to those interfaces.

Beyond the patch

An unauthenticated, network-reachable code execution flaw in central management products is first an exposure problem: an internet-facing management interface is the entry point. Our Virtual CISO Services (vCISO) include exposure management for exactly this — finding internet-reachable management interfaces and open ports before an attacker does. Because no fixed release is listed in the CVE record, the patch window is set by Fortinet's release cycle and your visibility into it; our Supply Chain Defense & Third-Party Risk service tracks which vendors' software you run and how quickly fixes are published, so you can plan the response window.