Paper/Archive/CVE-2026-126261

CVE-2026-126261

Fortinet FortiManager — A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5…

CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets.

Affected

ProductAffectedFixed inSource

FortiManager8.0.0–CNA

FortiManager7.6.0 – 7.6.7–CNA

FortiManager7.4.0 – 7.4.5–CNA

FortiManager7.2.0 – 7.2.8–CNA

Scores by source

fortinet (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References

reffortiguard.fortinet.com/psirt/FG-IR-26-275