---
id: "CVE-2026-126181"
page: "https://infrastack.ai/live/CVE-2026-126181"
kind: "vulnerability"
aliases: ["CVE-2026-126181"]
title: "FortiManager: hard-coded default key lets attackers join config-sync mesh"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiManager", "fixed": ["8.0.2", "7.6.8", "7.4.12"], "affected": ">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; 7.2 all versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortigate", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "no-fgfm-sync"]
published_at: "2026-11-11T22:17:16+00:00"
first_seen_at: "2026-11-11T22:29:30+00:00"
updated_at: "2026-11-11T22:44:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126181", "first_seen_at": "2026-11-11T22:29:30+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-226", "first_seen_at": "2026-11-11T22:44:06+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-226"]}]
exploit_sources: []
---

# FortiManager: hard-coded default key lets attackers join config-sync mesh

Link for people: https://infrastack.ai/live/CVE-2026-126181 (this .md is for agents)

Fortinet FG-IR-26-226: FortiManager uses a hard-coded default pre-shared key for the FGFM configuration-sync channel. An adjacent-network attacker who is authenticated with user permission may join the FGFM configuration-sync mesh of an affected FortiGate deployment. Fortinet rates it High (CVSS 8.0), lists impact as denial of service, and marks it not known exploited. Fortinet's page has no virtual patch and no workaround.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11; 7.2 all versions fixed 8.0.2, 7.6.8, 7.4.12

## How to check

- Check the FortiManager version (GUI dashboard or CLI 'get system status'). Affected: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, all 7.2.
- Check whether FortiGate devices are managed through FGFM on that FortiManager.
- Also check FortiManager Cloud / sibling FortiManager advisories (FG-IR-26-228) separately; this advisory lists only FortiManager versions.

## Fix

Upgrade FortiManager 8.0 to 8.0.2 or above, 7.6 to 7.6.8 or above, 7.4 to 7.4.12 or above. 7.2 has no fixed 7.2 release: migrate to a fixed release (per Fortinet).

## Timeline

- 2026-11-11T22:29:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126181
- 2026-11-11T22:44:06+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-226 — Restated FortiManager as one product row covering all branches.

## Documents

- [advisory] Fortinet PSIRT FG-IR-26-226: Use of hard-coded credentials (CVE-2026-126181) https://fortiguard.fortinet.com/psirt/FG-IR-26-226

## From the sources

A use of hard-coded credentials vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions may allow an adjacent-network authenticated attacker with user permission to join the FGFM configuration-sync mesh of the affected FortiGate deployment via the default pre-shared key.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_