{"id":"CVE-2026-126170","aliases":["EUVD-2026-123844","GHSA-rm98-fc32-9ggj"],"status":"published","title":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8...","description":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:R","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00628,"percentile":0.50588,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-116"],"published":"2026-11-11T21:30:02.652Z","modified":"2026-11-12T00:33:03Z","exploits":[{"source":"pocgithub","id":"Ghost-Bx1/cve-2026-126170-fortimanager-jsonrpc-rce","title":"Ghost-Bx1/cve-2026-126170-fortimanager-jsonrpc-rce","date":"2026-11-11","url":"https://github.com/Ghost-Bx1/cve-2026-126170-fortimanager-jsonrpc-rce"},{"source":"pocgithub","id":"googlesky/CVE-2026-126170","title":"googlesky/CVE-2026-126170","date":"2026-11-12","url":"https://github.com/googlesky/CVE-2026-126170"}],"products":[{"vendor":"fortinet","product":"fortianalyzer"},{"vendor":"fortinet","product":"fortianalyzer cloud"},{"vendor":"fortinet","product":"fortianalyzer-bigdata"},{"vendor":"fortinet","product":"fortimanager"},{"vendor":"fortinet","product":"fortimanager cloud"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126170"},{"url":"https://github.com/advisories/GHSA-rm98-fc32-9ggj"}],"sources":{"cve":[{"id":"CVE-2026-126170","description":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request","status":"published","published":"2026-11-11T21:30:02.652Z","modified":"2026-11-11T21:30:02.652Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:R","level":"critical","assessor":"cna"}],"cwes":["CWE-116"],"updated_at":"2026-11-11T22:33:40.554088Z"}],"euvd":[{"id":"EUVD-2026-123844","description":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request","status":"published","published":"2026-11-12T00:32:56Z","modified":"2026-11-12T00:32:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:R","level":"critical"}],"updated_at":"2026-11-12T01:31:24.707094Z"}],"ghsa":[{"id":"GHSA-rm98-fc32-9ggj","title":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8...","description":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request","status":"published","published":"2026-11-12T00:32:56Z","modified":"2026-11-12T00:33:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-116"],"updated_at":"2026-11-12T00:37:18.265111Z"}],"nvd":[{"id":"CVE-2026-126170","description":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request","status":"published","published":"2026-11-11T22:17:15.34Z","modified":"2026-11-11T22:17:15.34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-116"],"updated_at":"2026-11-11T23:26:41.421267Z"}]}}