FortiAnalyzer and FortiManager SQL injection via OFTP allows unauthenticated code execution (CVE-2026-126262)

What happened

CVE-2026-126262 is an SQL injection vulnerability in FortiAnalyzer and FortiManager. An unauthenticated attacker who can reach the OFTP port may send crafted OFTP packets and execute code or commands on the system. No credentials and no user interaction are required. The CVSS v3.1 score is 9.3 (critical), with high impact on confidentiality, integrity and availability.

Fortinet has published a security advisory; no fixed release is listed in the CVE record. The record does not indicate active exploitation or public disclosure.

Who is affected

Affected releases are FortiAnalyzer 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11 and 7.2.0 through 7.2.12, and FortiManager 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11 and 7.2.0 through 7.2.12. The exposure condition is reachability of the OFTP port.

What to do now

1. Restrict access to the OFTP port so only trusted devices can reach affected FortiAnalyzer and FortiManager systems.
2. Move these systems to a dedicated management network segment with no inbound access from untrusted networks.
3. Monitor OFTP connection attempts and logs for unexpected or unfamiliar sources.
4. Monitor Fortinet's security advisory for a fixed release; no fixed release or vendor workaround is listed yet.

How to detect it

No indicators of compromise are listed for CVE-2026-126262 in the CVE record. Detection should start with exposure: maintain an inventory of hosts permitted to reach the OFTP port, and alert on connection attempts from any other source.

Beyond the patch

An unauthenticated, network-reachable injection flaw is the kind of exposure that should be caught before an advisory names it. Virtual CISO Services (vCISO) gives an outside-in view of exposed management ports such as OFTP, and Implementation & Assessment Services can test for injection flaws and harden Fortinet deployments. For organisations running many vendor appliances, Supply Chain Defense & Third-Party Risk tracks suppliers' patch cycles and the exposure window they create.