FortiManager and FortiAnalyzer blind XPath injection allows unauthenticated tampering with signed SAML responses (CVE-2026-126176)

What happened

The CVE record describes an XML injection flaw, also called blind XPath injection, in SAML request handling in FortiManager, FortiAnalyzer and their cloud editions. An unauthenticated remote attacker can send crafted SAML requests. No user interaction or prior credentials are required, although the vulnerability has high attack complexity. Successful exploitation may allow the attacker to inject arbitrary content into a signed SAML response, primarily affecting the integrity of identity assertions.

The CVSS 3.1 score is 8.1, high severity, with changed scope, high integrity impact and lower confidentiality and availability impacts. The CVE record does not list known exploitation, and Fortinet has not said the flaw is under active attack. Because the flaw is reachable over the network without authentication, deployments where these systems or their SAML endpoints are exposed to untrusted networks carry the greatest risk.

Who is affected

Affected versions are:

• FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11 and 7.2.0 through 7.2.12
• FortiAnalyzer 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11 and 7.2.0 through 7.2.12
• FortiAnalyzer Cloud 8.0.0, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11 and 7.2.1 through 7.2.12
• FortiManager Cloud 8.0.0, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11 and 7.2.1 through 7.2.12

If your organisation runs any of these products in these ranges, treat the system as affected.

What to do now

1. Check whether you run an affected version of FortiManager, FortiAnalyzer, FortiManager Cloud or FortiAnalyzer Cloud. The affected ranges are listed above.
2. Treat this as unfixed. Fortinet has not published fixed versions or a vendor workaround, so do not wait for a patch announcement before reducing exposure.
3. Restrict network access to the affected systems, especially SAML login endpoints, to trusted management networks or VPNs, and remove them from direct internet reachability where possible.
4. Periodically check Fortinet's PSIRT reference for this issue for updated guidance; no fixed version or workaround is listed as of this advisory.
5. Review SAML authentication activity for unexpected or malformed requests until Fortinet publishes further guidance.

How to detect it

Fortinet has not published vendor-specific indicators for this flaw. Until Fortinet publishes further guidance, monitor SAML authentication logs for unexpected or malformed SAML requests involving the affected FortiManager and FortiAnalyzer systems, particularly where those endpoints are reachable from untrusted networks.

Beyond the patch

This is an unauthenticated, network-reachable issue in management and analytics systems; the immediate task is to reduce exposure. Virtual CISO Services (vCISO) can help locate internet-facing FortiManager and FortiAnalyzer deployments and tighten access. Because your exposure window depends on Fortinet's patch cycle, Supply Chain Defense & Third-Party Risk can help you track the affected products in your estate and the vendor's fix timeline.