Search threats, CVEs… ⌘K
Back to vendor advisories
Fortinet PSIRT AdvisoriesFG-IR-26-251

Improper neutralization of special elements used in an os command in GUI

HighVendor CVSS 7.2 / 10 1 CVE Published Nov 10, 2026 at 8:00 AM UTC
Get alerts for FortiManager

Summary

CVSSv3 Score:

7.2

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [cwe-78] in FortiManager, FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud, FortiSASE-Sovereign GUI may allow an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests

Revised on 2026-11-10 00:00:00

Products covered

  • FortiManager

  • FortiAnalyzer

  • FortiManager Cloud

  • FortiAnalyzer Cloud

  • FortiSASE-Sovereign

Remediation

Separate remediation guidance was not included in the collected bulletin.

CVEs in this advisory 1

CVE-2026-126236

Updates

  1. Published by Fortinet

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

Keep investigating
See every advisory from this vendor