FORTIMANAGER · CVE-2026-126182 · Vendor
FIX → 8.0.2 · 7.6.8 +2 ✓ verified
FortiManager, Fortinet's central management appliance for firewalls, has a code injection flaw in several 7.x and 8.0 releases, including FortiManager Cloud. A remote attacker with a valid login can run unauthorized code or commands on the device by sending crafted HTTP requests.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running FortiManager or FortiManager Cloud (and FortiAnalyzer / FortiAnalyzer Cloud, per the same Fortinet advisory) in the listed versions. The attacker needs a valid login and sends crafted HTTP requests, so exposure depends on who can log in to the management interface. Fortinet notes the JSON API route applies when enabled (off by default). Versions at or above the fixed releases can skip it.
Not affected if json-api-disabled, versions-outside-ranges
Who cares authenticated, firewall-management, fortimanager, fortinet, self-hosted
A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
This page as ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
get system status) against: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12 (Cloud 7.4 and 7.2: from 7.4.1 and 7.2.1)config system admin profile / edit <profile name> / set rpc-permit none / endUpgrade to 8.0.2 · 7.6.8 +2
8.0.2 (from 8.0.0-8.0.1), 7.6.8 (from 7.6.0-7.6.7), 7.4.12 (from 7.4.0-7.4.11) or 7.2.13 (from 7.2.0-7.2.12), or laterNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.