FortiAnalyzer unauth RCE in FortiManager too (CVE-2026-126170) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-126170 is a critical unauthenticated code execution vulnerability in Fortinet FortiAnalyzer and FortiManager 7.6.0 through 7.6.7 and 8.0.0 through 8.0.2 (plus Cloud and FortiAnalyzer-BigData builds) that lets a remote attacker run unauthorized code or commands through a specially crafted HTTP request. No credentials or user interaction are required, and patches are available in 7.6.8 and 8.0.3 - update immediately.

Overview

CVE-2026-126170 is an improper encoding or escaping of output flaw in Fortinet’s security management and logging platforms. When FortiAnalyzer or FortiManager processes a crafted HTTP request, improperly neutralized output lets the attacker inject content that the application later executes. Because the request needs no authentication, any host that can reach the management interface can attempt it.

The exposure spans a wide footprint:

• FortiAnalyzer 8.0.0-8.0.2 and 7.6.0-7.6.7
• FortiAnalyzer Cloud 8.0.1-8.0.2 and 7.6.0-7.6.7
• FortiAnalyzer-BigData 7.6.0-7.6.2
• FortiManager 8.0.0-8.0.2 and 7.6.0-7.6.7
• FortiManager Cloud 8.0.1-8.0.2 and 7.6.0-7.6.7

Impact

A successful attack gives an unauthenticated outsider the ability to execute arbitrary code or commands on the appliance, at the privilege level of the affected service. These systems sit at the heart of a Fortinet estate: FortiManager pushes policy to managed firewalls, and FortiAnalyzer holds logs, alerts, and configuration data for the whole network. Compromise of either can expose sensitive telemetry, allow tampering with policy distribution, and provide a foothold for lateral movement toward the firewalls those platforms control. The low attack complexity and absence of any prerequisite privileges make this trivially reachable from the network.

Remediation

Fortinet has released fixes. Upgrade to the first patched release in your branch: 7.6.8 or 8.0.3 for FortiAnalyzer and FortiManager, with corresponding Cloud and BigData builds per the vendor advisory. Because a public proof-of-concept exists, prioritize internet-facing and edge deployments.

If immediate upgrade is not possible, restrict management access to trusted administrative networks, disable unnecessary internet exposure of the GUI and API, and monitor for anomalous HTTP requests to the appliance. Where feasible, keep management interfaces on a dedicated segment separated from user traffic.

Security Insight

This case echoes the FortiMail zero-day (CVE-2026-104286) in that both put an unauthenticated attack surface on a Fortinet management-class product, and it follows the pattern seen with FortiClient EMS exploitation: adversaries consistently gravitate toward the consoles that control security infrastructure. The recurring output-encoding class of bug across Fortinet’s portfolio suggests input handling on management interfaces is not being hardened uniformly. Track related activity in our weekly threat roundup and the FortiMail advisory for broader context.

Further Reading

• FortiMail zero-day CVE-2026-104286 exploited
• Weekly Threat Roundup: Nx Console Supply Chain Attack (May 25-31)
• Threat Actors Exploit Critical FortiClient EMS Flaw to
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs