FORTIMANAGER · CVE-2026-126181 · Vendor
FIX → 8.0.2 · 7.6.8 +1 ✓ verified
Fortinet FG-IR-26-226: FortiManager uses a hard-coded default pre-shared key for the FGFM configuration-sync channel. An adjacent-network attacker who is authenticated with user permission may join the FGFM configuration-sync mesh of an affected FortiGate deployment. Fortinet rates it High (CVSS 8.0), lists impact as denial of service, and marks it not known exploited. Fortinet's page has no virtual patch and no workaround.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-hosted FortiManager 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11 or any 7.2 that manage FortiGate devices over FGFM. The attacker must be on an adjacent network and hold a user-level permission, so exposure depends on who can reach the management network. Fixed versions are not affected.
Not affected if auth-required, no-fgfm-sync
Who cares fortigate, fortimanager, fortinet, self-hosted
A use of hard-coded credentials vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions may allow an adjacent-network authenticated attacker with user permission to join the FGFM configuration-sync mesh of the affected FortiGate deployment via the default pre-shared key.
This page as .md · .json · CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.0.2 · 7.6.8 +1
Upgrade FortiManager 8.0 to 8.0.2 or above, 7.6 to 7.6.8 or above, 7.4 to 7.4.12 or above. 7.2 has no fixed 7.2 release: migrate to a fixed release (per Fortinet).