---
id: "CVE-2026-126180"
page: "https://infrastack.ai/live/CVE-2026-126180"
kind: "vulnerability"
aliases: ["CVE-2026-126180"]
title: "Fortinet FortiManager: low-privilege admin can gain super admin on FortiGates"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiManager", "fixed": ["7.4.12", "7.6.8", "8.0.2"], "affected": ">= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1; 7.2 all versions", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["fortigate", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "no-fortimanager", "standalone-fortigate"]
published_at: "2026-11-11T22:17:16+00:00"
first_seen_at: "2026-11-11T22:29:29+00:00"
updated_at: "2026-11-11T22:44:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126180", "first_seen_at": "2026-11-11T22:29:29+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-225", "first_seen_at": "2026-11-11T22:44:04+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-225"]}]
exploit_sources: []
---

# Fortinet FortiManager: low-privilege admin can gain super admin on FortiGates

Link for people: https://infrastack.ai/live/CVE-2026-126180 (this .md is for agents)

A template engine flaw in FortiManager lets a low-privileged Device Manager admin inject commands that run on managed FortiGate devices. The result is super admin privilege on those FortiGates.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 7.4.0, <= 7.4.11; >= 7.6.0, <= 7.6.7; >= 8.0.0, <= 8.0.1; 7.2 all versions fixed 7.4.12, 7.6.8, 8.0.2

## How to check

Check the FortiManager version (GUI dashboard or CLI 'get system status'). Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2 all versions; FortiManager Cloud 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.1-7.4.11, 7.2 all. Also list which admin accounts hold a Device Manager profile, since the attacker needs one (authenticated).

## Fix

Upgrade FortiManager and FortiManager Cloud: 8.0.x to 8.0.2+, 7.6.x to 7.6.8+, 7.4.x to 7.4.12+. 7.2 (all versions) has no patch: migrate to a fixed release.

## Timeline

- 2026-11-11T22:29:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126180
- 2026-11-11T22:44:04+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-225 — Restating FortiManager as one product row covering all branches.

## Documents

- [advisory] Fortinet FG-IR-26-225: template engine injection in FortiManager https://fortiguard.fortinet.com/psirt/FG-IR-26-225

## From the sources

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a low privileged Device Manager admin to obtain super admin privilege on managed FortiGates via injecting malicious commands.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_