Fortinet FortiManager and FortiAnalyzer Vulnerable to Server-Side Template Injection

Fortinet has issued a security advisory for a critical Server-Side Template Injection (SSTI) vulnerability, identified as CWE-1336, impacting several of its widely used management and analysis platforms. The vulnerability, cataloged under FG-IR-26-249 and assigned CVE-2026-126234, affects FortiManager, FortiManager Cloud, FortiAnalyzer, and FortiAnalyzer Cloud.

An authenticated attacker with restricted privileges can exploit this flaw by crafting and sending a malicious request to the vulnerable systems. Successful exploitation could allow the attacker to execute arbitrary code or commands on the affected devices, leading to a complete compromise of the system's integrity and confidentiality. The CVSS 3.1 score for this vulnerability is 7.2 (High), with a vector indicating network accessibility, low complexity, high privileges required, no user interaction, and significant impact on confidentiality, integrity, and availability.

The vulnerability was discovered internally by David Maciejak of the Fortinet Product Security team, with assistance from the Claude Mythos AI model. This discovery highlights the increasing role of AI in both discovering and potentially exploiting security weaknesses.

Specifically, the affected versions include FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, and FortiManager Cloud 8.0.0. Fortinet has provided patches and mitigation guidance through its Product Security Incident Response Team (PSIRT) portal.

Server-Side Template Injection vulnerabilities arise when an application uses user-supplied input to construct template strings that are then processed by a template engine. If special characters or syntax within the template engine are not properly neutralized, an attacker can inject malicious code that gets executed on the server.

While the advisory does not detail specific exploitation scenarios or in-the-wild activity, the potential impact is severe. Compromised FortiManager or FortiAnalyzer instances could lead to unauthorized access to sensitive network configurations, logs, and potentially serve as a pivot point for further network intrusions.

Fortinet has released updates to address this vulnerability. Users of the affected products are strongly urged to apply these patches as soon as possible to mitigate the risk of exploitation. The advisory also notes that the vulnerability was discovered internally, suggesting that public exploitation may not yet be widespread, but proactive patching remains critical.