CVE-2026-126262

waiting for further signals

EUVD-2026-123908 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Fortinet FortiAnalyzer >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; >= 7.2.0, <= 7.2.12; 8.0.0

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

ETK-2026-4224, permanent identifier

cvss9.3cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

2h 42msince last run

9mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+0h49m

+2h

+4h

+6h

+8h

+10h

+12h

description

FortiAnalyzer 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11, and 7.2.0–7.2.12, plus the listed FortiManager releases, are affected. An unauthenticated attacker that can access the OFTP port may execute commands or code on the appliance.

mitigation

Restrict access to the OFTP port to trusted, necessary network sources and block it from untrusted networks. Monitor for and apply Fortinet remediation when it is released; no fixed version is recorded.

check

exploit

automation

contextual

auth required

EPSS

–

agent run time

cve.org record, t = 0

2026-11-11 21:31Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-11 21:31Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-126262

this entry in the feed

GET /api/v1/feed/CVE-2026-126262

{
  "etk_id": "ETK-2026-4224",
  "cve_id": "CVE-2026-126262",
  "display_id": "CVE-2026-126262",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-123908",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in FortiAnalyzer and FortiManager",
  "summary": "FortiAnalyzer 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11, and 7.2.0–7.2.12, plus the listed FortiManager releases, are affected. An unauthenticated attacker that can access the OFTP port may execute commands or code on the appliance.",
  "mitigation": "Restrict access to the OFTP port to trusted, necessary network sources and block it from untrusted networks. Monitor for and apply Fortinet remediation when it is released; no fixed version is recorded.",
  "vendor": "Fortinet",
  "product": "FortiAnalyzer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 8.0.0, <= 8.0.1",
        ">= 7.6.0, <= 7.6.7",
        ">= 7.4.0, <= 7.4.11",
        ">= 7.2.0, <= 7.2.12"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "FortiAnalyzer",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "8.0.0",
        ">= 7.6.0, <= 7.6.7",
        ">= 7.4.0, <= 7.4.11",
        ">= 7.2.0, <= 7.2.12"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "FortiManager",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.205799466666667,
  "t0_at": "2026-11-11T21:31:54.288000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T21:31:54.288000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T21:31:54.288000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-126262"
    }
  }
}

published 2026-11-11 22:11Z
last change 2026-11-11 22:51Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.