CVE-2026-126227

Confused Deputy Vulnerability Allowing Cross-Component Command Execution in FortiAnalyzer and FortiManager Products

A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the intended scope via specially crafted HTTP request

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortianalyzer Fortianalyzercloud Fortimanager and 1 more

CVE-2026-126215

Incorrect Authorization in FortiAnalyzer and FortiManager Allow Admin Privilege Escalation

A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortianalyzer Fortianalyzercloud Fortimanager and 1 more

CVE-2026-126214

Authentication Bypass via Spoofed GUI Requests Enabling Privilege Escalation

A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortianalyzer Fortianalyzercloud Fortimanager

CVE-2026-126241

Unauthorized SQL Injection in Fortinet FortiAuthenticator 8.0.x and 6.6.x

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized SQL commands on the underlying database.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortiauthenticator

CVE-2026-126245

Out‑of‑Bounds Write in FortiAuthenticator Allows Unauthorized Code Execution

A out-of-bounds write vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to execute unauthorized code or commands via http requests, should the attacker be able to defeat ASLR protections.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortiauthenticator

CVE-2026-126249

Privilege Escalation in Fortinet FortiAuthenticator via Improper Authorization Control

A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to escalate privileges.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortiauthenticator

CVE-2026-126246

Denial of Service Vulnerability via Null Pointer Dereference in Fortinet FortiAuthenticator

A null pointer dereference vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform a denial of service attack via http requests.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortiauthenticator

CVE-2026-126248

Insufficiently Protected Credentials in FortiAuthenticator Allowing Sensitive Information Disclosure Over HTTPS

A insufficiently protected credentials vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to obtain sensitive information via HTTPS requests.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortiauthenticator

CVE-2026-126251

Authorization Bypass in FortiAuthenticator Allows Unauthorized Access

A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortiauthenticator

CVE-2026-126252

Authenticated SQL Injection Enabling Unauthorized Code Execution in FortiAuthenticator

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized code or commands via http requests

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortiauthenticator

CVE-2026-126255

Unauthenticated Path Traversal Enabling Authentication Bypass in Fortinet FortiOS and FortiPAM

A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortios Fortipam

CVE-2026-126259

Unauthenticated HA Packet Manipulation Enables Super Admin Command Execution in FortiOS

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortios

CVE-2026-120807

Privilege escalation via fail-open user lookup in X.509 cluster-membership guard

A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated internal privileges when a specific deployment configuration is in use. An internal check, which prevents a certificate recognized as a cluster member from also being treated as a regular user, does not correctly distinguish between certain error conditions encountered during user lookup. Under certain timing conditions, this can cause the check to be bypassed, granting the connection full internal system privileges. Triggering this issue requires possession of a valid cluster-member TLS certificate, non-default X.509 cluster authentication configuration, and specific conditions during the user cache lookup process.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-121287

Security Advisory 0221

An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121290

Security Advisory 0209

On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121291

Security Advisory 0222

A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-120828

Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage

A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these records to accumulate without bound and persist after the requests end, which may make the server run out of memory and become unavailable.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-121890

Adobe Connect | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Connect

CVE-2026-121904

Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Connect

CVE-2026-121910

Adobe Connect | Cross-site Scripting (XSS) (CWE-79)

Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Connect