FORTIMANAGER · CVE-2026-126180 · Vendor
FIX → 8.0.2 · 7.6.8 +1 ✓ verified
A template engine flaw in FortiManager lets a low-privileged Device Manager admin inject commands that run on managed FortiGate devices. The result is super admin privilege on those FortiGates.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running FortiManager or FortiManager Cloud that manage FortiGates, where someone beyond full admins holds a Device Manager admin profile. That person can inject commands via the template engine and get super admin on the managed FortiGates. Standalone FortiGates without FortiManager can skip it.
Not affected if auth-required, no-fortimanager, standalone-fortigate
Who cares fortigate, fortimanager, fortinet, self-hosted
get system status)8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2 all versions; FortiManager Cloud , , , 7.2 allA improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a low privileged Device Manager admin to obtain super admin privilege on managed FortiGates via injecting malicious commands.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
8.0.0-8.0.17.6.0-7.6.77.4.1-7.4.11Upgrade to 8.0.2 · 7.6.8 +1
Upgrade FortiManager and FortiManager Cloud: 8.0.x to 8.0.2+, 7.6.x to 7.6.8+, 7.4.x to 7.4.12+. 7.2 (all versions) has no patch: migrate to a fixed release.