Fortinet FortiManager and FortiAnalyzer Vulnerable to Code Injection
Fortinet has issued a security advisory for a critical code injection vulnerability affecting its FortiManager and FortiAnalyzer products, allowing authenticated administrators to execute unauthorized commands.
Fortinet has released security advisory FG-IR-26-230 detailing a critical vulnerability, identified as CWE-94 (Improper control of generation of code), that impacts several versions of its FortiManager and FortiAnalyzer products, including their cloud-based counterparts.
The vulnerability allows an authenticated administrator to execute arbitrary code or commands on the affected systems. This is achieved by sending specially crafted requests to the vulnerable products, which then fail to properly sanitize or validate the input, leading to the injection and execution of malicious code. The advisory assigns a CVSSv3 score of 7.2, classifying it as high severity.
This flaw specifically targets the code generation processes within FortiManager and FortiAnalyzer. These devices are crucial for network management and security analysis, making a compromise particularly impactful. An attacker who gains administrative access could leverage this vulnerability to gain deeper control over the network infrastructure managed by these devices, potentially leading to widespread compromise, data exfiltration, or disruption of services.
The advisory lists a broad range of affected versions for both FortiManager and FortiAnalyzer, spanning from version 7.4.0 up to the latest 8.0.1 releases for each product line. This wide scope suggests a significant number of Fortinet customers could be at risk if they are running unpatched versions.
Fortinet has stated that the vulnerability was discovered internally by Loic Pantano of the Fortinet Product Security team, with assistance from the Claude Mythos AI model. This highlights the increasing role of AI in both discovering and potentially exploiting security vulnerabilities.
While the advisory does not explicitly mention whether this vulnerability is being actively exploited in the wild, the nature of code injection flaws often makes them prime targets for exploitation. Organizations using affected Fortinet products are strongly advised to review the advisory and apply the necessary updates or mitigations as soon as possible to protect their environments.
Fortinet has not yet released specific patches for all affected versions, but the advisory indicates that updates are forthcoming. Customers are urged to monitor the Fortinet PSIRT advisories page for the latest information and to implement any recommended workarounds in the interim. The company's commitment to security is underscored by its proactive disclosure and internal discovery process.
This advisory details two vulnerabilities: CVE-2026-36575 (CWE-94, Code Injection) and CVE-2026-36576 (CWE-120, Buffer Overflow). Both allow remote authenticated attackers to execute unauthorized code or commands via crafted HTTP requests. The vulnerabilities were discovered internally by a member of the Fortinet Product Security team.