{"id":"CVE-2026-126180","kind":"vulnerability","aliases":["CVE-2026-126180"],"related":[],"title":"Fortinet FortiManager: low-privilege admin can gain super admin on FortiGates","description":"A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a low privileged Device Manager admin to obtain super admin privilege on managed FortiGates via injecting malicious commands.","summary":"A template engine flaw in FortiManager lets a low-privileged Device Manager admin inject commands that run on managed FortiGate devices. The result is super admin privilege on those FortiGates.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["7.4.12","7.6.8","8.0.2"],"affected":">= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1; 7.2 all versions","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["fortigate","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["auth-required","no-fortimanager","standalone-fortigate"],"how_to_check":"Check the FortiManager version (GUI dashboard or CLI 'get system status'). Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2 all versions; FortiManager Cloud 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2 all. Also list which admin accounts hold a Device Manager profile, since the attacker needs one (authenticated).","fix":"Upgrade FortiManager and FortiManager Cloud: 8.0.x to 8.0.2+, 7.6.x to 7.6.8+, 7.4.x to 7.4.12+. 7.2 (all versions) has no patch: migrate to a fixed release.","status":"open","published_at":"2026-11-11T22:17:16+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","triaged_at":"2026-11-11T22:31:32+00:00","updated_at":"2026-11-11T22:44:10+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:31:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiManager: low-privilege admin can gain super admin on FortiGates","impact":"high","summary":"A template engine flaw in FortiManager lets a low-privileged Device Manager admin inject commands that run on managed FortiGate devices. The result is super admin privilege on those FortiGates.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimanager","fortigate","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains super admin on managed FortiGate firewalls","analyst_note":"Fixed versions and vendor advisory not in sources; check fortiguard.com PSIRT advisory for CVE-2026-126180.","how_to_check":"- Check the FortiManager version under the admin dashboard or with `get system status` against the ranges listed in the description (8.0.0 to 8.0.1, 7.6.0 to 7.6.7, 7.4.0 to 7.4.11, 7.2 all versions).\n- Confirm whether FortiManager Cloud is in use and which version it runs.\n- Note which accounts hold the Device Manager profile.","plain_action":"","product_name":"FortiManager","needs_analyst":true,"not_affected_if":["no-fortimanager","standalone-fortigate"],"who_is_affected":"FortiManager and FortiManager Cloud deployments that manage FortiGate devices, where Device Manager admin accounts exist. Standalone FortiGates without FortiManager are not described as affected. The sources do not state a fixed version.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4689,"output_tokens":620,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed versions and vendor advisory not in sources; check fortiguard.com PSIRT advisory for CVE-2026-126180.","search":"'-126180':15A,18A '-2026':14A,17A '7.2':85C,105C '7.4.0':81C '7.4.1':100C '7.4.11':83C,102C '7.6.0':77C,95C '7.6.7':79C,97C '8.0.0':73C,90C '8.0.1':75C,92C 'admin':6A,10A,40B,53B,115C,119C 'allow':109C 'cloud':89C,94C,99C,104C 'command':42B,127C 'cve':13A,16A 'devic':38B,48B,113C 'element':63C 'engin':29B,68C 'flaw':30B 'fortig':12A,20B,47B,57B,123C 'fortimanag':2A,21B,32B,72C,76C,80C,84C,88C,93C,98C,103C 'fortimanager':19A 'fortinet':1A,22B,71C 'gain':8A 'host':25B 'improp':59C 'inject':41B,125C 'let':33B 'low':4A,36B,111C 'low-privileg':3A,35B 'malici':126C 'manag':39B,46B,114C,122C 'may':108C 'neutral':60C 'obtain':117C 'privileg':5A,37B,54B,112C,120C 'result':50B 'run':44B 'self':24B 'self-host':23B 'special':62C 'super':9A,52B,118C 'templat':28B,67C 'use':64C 'vendor':26B 'version':87C,107C 'via':124C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiManager or FortiManager Cloud that manage FortiGates, where someone beyond full admins holds a Device Manager admin profile. That person can inject commands via the template engine and get super admin on the managed FortiGates. Standalone FortiGates without FortiManager can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:44:04Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-225","run_id":3649},"products":{"at":"2026-11-11T22:44:10Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-225","run_id":3649},"how_to_check":{"at":"2026-11-11T22:44:04Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-225","run_id":3649},"who_affected":{"at":"2026-11-11T22:44:04Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-225","run_id":3649}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimanager"],"ptokens":["fortimanager"],"labels":["fortigate","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126180':15A,18A '-2026':14A,17A 'admin':6A,10A 'cve':13A,16A 'fortig':12A 'fortimanag':2A 'fortimanager':19A 'fortinet':1A 'gain':8A 'low':4A 'low-privileg':3A 'privileg':5A 'super':9A","search_b":"'admin':40B,53B 'command':42B 'devic':38B,48B 'engin':29B 'flaw':30B 'fortig':20B,47B,57B 'fortimanag':21B,32B 'fortinet':22B 'host':25B 'inject':41B 'let':33B 'low':36B 'low-privileg':35B 'manag':39B,46B 'privileg':37B,54B 'result':50B 'run':44B 'self':24B 'self-host':23B 'super':52B 'templat':28B 'vendor':26B","search_c":"'7.2':85C,105C '7.4.0':81C '7.4.1':100C '7.4.11':83C,102C '7.6.0':77C,95C '7.6.7':79C,97C '8.0.0':73C,90C '8.0.1':75C,92C 'admin':115C,119C 'allow':109C 'cloud':89C,94C,99C,104C 'command':127C 'devic':113C 'element':63C 'engin':68C 'fortig':123C 'fortimanag':72C,76C,80C,84C,88C,93C,98C,103C 'fortinet':71C 'improp':59C 'inject':125C 'low':111C 'malici':126C 'manag':114C,122C 'may':108C 'neutral':60C 'obtain':117C 'privileg':112C,120C 'special':62C 'super':118C 'templat':67C 'use':64C 'version':87C,107C 'via':124C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126180","severity":null,"published_at":"2026-11-11T22:17:16+00:00","modified_at":"2026-11-11T22:17:16+00:00","first_seen_at":"2026-11-11T22:29:29+00:00","fetched_at":"2026-11-11T22:29:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126180:3649","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-225","severity":null,"published_at":"2026-11-11T22:44:04+00:00","modified_at":"2026-11-11T22:44:10+00:00","first_seen_at":"2026-11-11T22:44:04+00:00","fetched_at":"2026-11-11T22:44:10+00:00","note":"Restating FortiManager as one product row covering all branches.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-225"]}],"documents":[{"id":129705,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-225","title":"Fortinet FG-IR-26-225: template engine injection in FortiManager","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}