Fortinet has disclosed a critical SQL injection vulnerability in FortiAnalyzer and FortiManager that an unauthenticated attacker could exploit through the OFTP log-transfer service to run code or commands on the system. The flaw, tracked as CVE-2026-126262, is rated 9.3 out of 10 and was published on 10 November 2026.

The advisory, FG-IR-26-276, describes the flaw as an improper neutralisation of special elements used in an SQL command, classified as CWE-89. Fortinet says an unauthenticated attacker who can reach the OFTP port may execute code or commands on the system by sending crafted OFTP packets. OFTP, the FortiAnalyzer log-transfer protocol, uses TCP port 514, and the key question for any organisation running these products is whether that service is reachable from untrusted networks.

Which versions are affected

CVE-2026-126262 affects FortiAnalyzer versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11 and 7.2.0 through 7.2.12, and the same branches of FortiManager where FortiAnalyzer features are enabled. The fixes depend on the branch: FortiAnalyzer 8.0 users should move to 8.0.2 or later and FortiManager 8.0 users to 8.0.1 or later, while the 7.6 branches need 7.6.8 or later, the 7.4 branches need 7.4.12 and the 7.2 branches need 7.2.13.

Administrators should match each product and branch to its own fixed release rather than assuming one upgrade covers every flaw in the batch. The same 10 November release included a companion OFTP flaw, CVE-2026-126260, a server-side request forgery issue rated 9.0, which also needs OFTP reachability and is fixed in the same patch cycle.

Why this flaw matters

FortiManager and FortiAnalyzer sit at the centre of many Fortinet deployments: FortiManager controls fleets of FortiGate firewalls, while FortiAnalyzer collects and stores their logs. A flaw that allows unauthenticated code execution on either product is therefore more serious than the same bug in an ordinary endpoint application, because the affected systems hold administrative access and sensitive log data.

Fortinet has a long history as a target for attackers. Its products are widely deployed, often exposed to the internet, and flaws in its management platforms have been exploited in past campaigns. That history is why security teams treat new critical Fortinet advisories as urgent even when no exploitation has been reported yet.

No exploitation reported at publication

Fortinet marked the flaw as not known to be exploited when the advisory was published on 10 November, and it had not appeared in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue as of 11 November. No public proof-of-concept exploit had been reported either. That position can change quickly, and the absence of reported exploitation is not the same as safety, particularly for a pre-authentication flaw on a service that may be internet-facing.

What administrators should do

First, identify every FortiManager and FortiAnalyzer deployment, including cloud variants and FortiAnalyzer BigData, and check whether OFTP is reachable from outside the trusted network. Systems where OFTP is exposed should be patched first. Then apply the fixed release for each product branch, and verify the upgrade completed on every system rather than assuming a central push succeeded.

Teams should also review preserved logs for unexpected activity around the OFTP service, and confirm the intended configuration after maintenance. Where a required release is still listed as upcoming for another flaw in the batch, Fortinet's documented workaround should be applied until the fixed version is available.

The practical message is straightforward: if OFTP on a FortiAnalyzer or FortiManager system can be reached by an attacker, CVE-2026-126262 needs patching now, before exploitation is reported rather than after.

Sources: Brandefense and GBHackers.