{"id":"CVE-2026-126181","kind":"vulnerability","aliases":["CVE-2026-126181"],"related":[],"title":"FortiManager: hard-coded default key lets attackers join config-sync mesh","description":"A use of hard-coded credentials vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions may allow an adjacent-network authenticated attacker with user permission to join the FGFM configuration-sync mesh of the affected FortiGate deployment via the default pre-shared key.","summary":"Fortinet FG-IR-26-226: FortiManager uses a hard-coded default pre-shared key for the FGFM configuration-sync channel. An adjacent-network attacker who is authenticated with user permission may join the FGFM configuration-sync mesh of an affected FortiGate deployment. Fortinet rates it High (CVSS 8.0), lists impact as denial of service, and marks it not known exploited. Fortinet's page has no virtual patch and no workaround.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["8.0.2","7.6.8","7.4.12"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; 7.2 all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortigate","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["auth-required","no-fgfm-sync"],"how_to_check":"- Check the FortiManager version (GUI dashboard or CLI 'get system status'). Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, all 7.2.\n- Check whether FortiGate devices are managed through FGFM on that FortiManager.\n- Also check FortiManager Cloud / sibling FortiManager advisories (FG-IR-26-228) separately; this advisory lists only FortiManager versions.","fix":"Upgrade FortiManager 8.0 to 8.0.2 or above, 7.6 to 7.6.8 or above, 7.4 to 7.4.12 or above. 7.2 has no fixed 7.2 release: migrate to a fixed release (per Fortinet).","status":"open","published_at":"2026-11-11T22:17:16+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:31:51+00:00","updated_at":"2026-11-11T22:44:09+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:31:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FortiManager: hard-coded default key lets attackers join config-sync mesh","impact":"high","summary":"FortiManager ships with a default pre-shared key for the FGFM configuration-sync channel that cannot be changed, so an attacker can join the sync mesh of affected FortiGate deployments. The sources say this needs an adjacent-network attacker who already holds a user-level account on the device.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimanager","fortigate","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker joins FortiGate configuration-sync mesh using the default key","analyst_note":"Fixed versions and the vendor advisory are not in the sources; check the Fortinet PSIRT advisory for this CVE for the fix and any workaround.","how_to_check":"- Check the FortiManager version under System Settings or with `get system status` and compare it to the affected ranges: 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, and all 7.2 versions.\n- Check whether FortiGate devices are managed through FGFM configuration sync on the affected FortiManager.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","no-fgfm-sync"],"who_is_affected":"Organisations running affected FortiManager versions to manage FortiGate firewalls. The sources describe an adjacent-network attacker with user-level permission, so exposure depends on who can reach the management network and holds an account. Deployments on fixed versions or without FGFM sync may skip this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4623,"output_tokens":634,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed versions and the vendor advisory are not in the sources; check the Fortinet PSIRT advisory for this CVE for the fix and any workaround.","search":"'-126181':16A,19A '-2026':15A,18A '-226':33B '26':32B '7.2':127C '7.4.0':123C '7.4.11':125C '7.6.0':119C '7.6.7':121C '8.0':81B '8.0.0':115C '8.0.1':117C 'adjac':54B,134C 'adjacent-network':53B,133C 'affect':73B,151C 'allow':131C 'attack':8A,56B,137C 'authent':59B,136C 'channel':51B 'code':4A,39B,109C 'config':11A 'config-sync':10A 'configur':49B,68B,146C 'configuration-sync':48B,67B,145C 'credenti':110C 'cve':14A,17A 'cvss':80B 'default':5A,40B,156C 'denial':85B 'deploy':75B,153C 'exploit':93B 'fg':30B 'fg-ir':29B 'fgfm':47B,66B,144C 'fortig':21B,74B,152C 'fortimanag':1A,22B,34B,114C,118C,122C,126C 'fortimanager':20A 'fortinet':23B,28B,76B,94B,113C 'hard':3A,38B,108C 'hard-cod':2A,37B,107C 'high':79B 'host':26B 'impact':83B 'ir':31B 'join':9A,64B,142C 'key':6A,44B,160C 'known':92B 'let':7A 'list':82B 'mark':89B 'may':63B,130C 'mesh':13A,70B,148C 'network':55B,135C 'page':96B 'patch':100B 'permiss':62B,140C 'pre':42B,158C 'pre-shar':41B,157C 'rate':77B 'self':25B 'self-host':24B 'servic':87B 'share':43B,159C 'sync':12A,50B,69B,147C 'use':35B,105C 'user':61B,139C 'vendor':27B 'version':129C 'via':154C 'virtual':99B 'vulner':111C 'workaround':103B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted FortiManager 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11 or any 7.2 that manage FortiGate devices over FGFM. The attacker must be on an adjacent network and hold a user-level permission, so exposure depends on who can reach the management network. Fixed versions are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:44:09Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-226","run_id":3648},"products":{"at":"2026-11-11T22:44:09Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-226","run_id":3648},"how_to_check":{"at":"2026-11-11T22:44:09Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-226","run_id":3648},"who_affected":{"at":"2026-11-11T22:44:09Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-226","run_id":3648}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimanager"],"ptokens":["fortimanager"],"labels":["fortigate","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126181':16A,19A '-2026':15A,18A 'attack':8A 'code':4A 'config':11A 'config-sync':10A 'cve':14A,17A 'default':5A 'fortimanag':1A 'fortimanager':20A 'hard':3A 'hard-cod':2A 'join':9A 'key':6A 'let':7A 'mesh':13A 'sync':12A","search_b":"'-226':33B '26':32B '8.0':81B 'adjac':54B 'adjacent-network':53B 'affect':73B 'attack':56B 'authent':59B 'channel':51B 'code':39B 'configur':49B,68B 'configuration-sync':48B,67B 'cvss':80B 'default':40B 'denial':85B 'deploy':75B 'exploit':93B 'fg':30B 'fg-ir':29B 'fgfm':47B,66B 'fortig':21B,74B 'fortimanag':22B,34B 'fortinet':23B,28B,76B,94B 'hard':38B 'hard-cod':37B 'high':79B 'host':26B 'impact':83B 'ir':31B 'join':64B 'key':44B 'known':92B 'list':82B 'mark':89B 'may':63B 'mesh':70B 'network':55B 'page':96B 'patch':100B 'permiss':62B 'pre':42B 'pre-shar':41B 'rate':77B 'self':25B 'self-host':24B 'servic':87B 'share':43B 'sync':50B,69B 'use':35B 'user':61B 'vendor':27B 'virtual':99B 'workaround':103B","search_c":"'7.2':127C '7.4.0':123C '7.4.11':125C '7.6.0':119C '7.6.7':121C '8.0.0':115C '8.0.1':117C 'adjac':134C 'adjacent-network':133C 'affect':151C 'allow':131C 'attack':137C 'authent':136C 'code':109C 'configur':146C 'configuration-sync':145C 'credenti':110C 'default':156C 'deploy':153C 'fgfm':144C 'fortig':152C 'fortimanag':114C,118C,122C,126C 'fortinet':113C 'hard':108C 'hard-cod':107C 'join':142C 'key':160C 'may':130C 'mesh':148C 'network':135C 'permiss':140C 'pre':158C 'pre-shar':157C 'share':159C 'sync':147C 'use':105C 'user':139C 'version':129C 'via':154C 'vulner':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126181","severity":null,"published_at":"2026-11-11T22:17:16+00:00","modified_at":"2026-11-11T22:17:16+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126181:3648","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-226","severity":null,"published_at":"2026-11-11T22:44:06+00:00","modified_at":"2026-11-11T22:44:09+00:00","first_seen_at":"2026-11-11T22:44:06+00:00","fetched_at":"2026-11-11T22:44:09+00:00","note":"Restated FortiManager as one product row covering all branches.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-226"]}],"documents":[{"id":129704,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-226","title":"Fortinet PSIRT FG-IR-26-226: Use of hard-coded credentials (CVE-2026-126181)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}