CVE-2022-26121: Fortinet Fortianalyzer

Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days.

An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11, 5.6.0 through 5.6.11 may allow an unauthenticated and remote attacker to access report template images via referencing the name in the URL path.

Affected products

• Fortinet Fortianalyzer: after 5.6.0, up to and including 5.6.11; after 6.0.0, up to and including 6.0.11; after 6.2.0, up to and including 6.2.9; after 6.4.0, up to and including 6.4.8; after 7.0.0, up to and including 7.0.3
• Fortinet FortiManager: after 5.6.0, up to and including 5.6.11; after 6.0.0, up to and including 6.0.11; after 6.2.0, up to and including 6.2.9; after 6.4.0, up to and including 6.4.8; after 7.0.0, up to and including 7.0.3

Published 2022-10-10. Last modified 2026-06-17.