CVE-2026-126226

Name of the Vulnerable Software and Affected Versions FortiAnalyzer version 8.0.0 FortiAnalyzer versions 7.6.0 through 7.6.7 FortiAnalyzer versions 7.4.0 through 7.4.11 FortiAnalyzer versions 7.2.0 through 7.2.12 FortiAnalyzer Cloud version 8.0.0 FortiAnalyzer Cloud versions 7.6.0 through 7.6.7 FortiAnalyzer Cloud versions 7.4.1 through 7.4.11 FortiAnalyzer Cloud versions 7.2.1 through 7.2.12 FortiManager version 8.0.0 FortiManager versions 7.6.0 through 7.6.7 FortiManager versions 7.4.0 through 7.4.11 FortiManager versions 7.2.0 through 7.2.12 FortiManager Cloud version 8.0.0 FortiManager Cloud versions 7.6.0 through 7.6.7 FortiManager Cloud versions 7.4.1 through 7.4.11 FortiManager Cloud versions 7.2.1 through 7.2.12

Description An OS command injection issue exists where improper neutralization of special elements used in an OS command allows an authenticated privileged attacker to execute unauthorized code or commands. This is achieved by using a crafted report schedule name.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.