{"id":"CVE-2026-126182","kind":"vulnerability","aliases":["CVE-2026-126182"],"related":[],"title":"Fortinet FortiManager: code injection lets an authenticated user run commands","description":"A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests.","summary":"FortiManager, Fortinet's central management appliance for firewalls, has a code injection flaw in several 7.x and 8.0 releases, including FortiManager Cloud. A remote attacker with a valid login can run unauthorized code or commands on the device by sending crafted HTTP requests.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["7.2.13"],"affected":">= 7.2.0, < 7.2.13","ecosystem":"vendor"},{"name":"FortiManager","fixed":["7.4.12"],"affected":">= 7.4.0, < 7.4.12","ecosystem":"vendor"},{"name":"FortiManager","fixed":["7.6.8"],"affected":">= 7.6.0, < 7.6.8","ecosystem":"vendor"},{"name":"FortiManager","fixed":["8.0.2"],"affected":">= 8.0.0, < 8.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","firewall-management","fortimanager","fortinet","self-hosted","vendor"],"not_affected_if":["json-api-disabled","versions-outside-ranges"],"how_to_check":"Check your FortiManager / FortiManager Cloud version (GUI dashboard or CLI 'get system status') against: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12 (Cloud 7.4 and 7.2: from 7.4.1 and 7.2.1). Fortinet says the flaw can be exploited via the JSON API if enabled (disabled by default). Workaround from Fortinet: on each admin profile with it enabled, run 'config system admin profile' / 'edit <profile name>' / 'set rpc-permit none' / 'end'. Also check FortiAnalyzer (same advisory, same ranges) if you run it.","fix":"Upgrade FortiManager and FortiManager Cloud to 8.0.2 (from 8.0.0-8.0.1), 7.6.8 (from 7.6.0-7.6.7), 7.4.12 (from 7.4.0-7.4.11) or 7.2.13 (from 7.2.0-7.2.12), or later. Same fixed versions for FortiAnalyzer and FortiAnalyzer Cloud.","status":"open","published_at":"2026-11-11T22:17:17+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:33:42+00:00","updated_at":"2026-11-11T22:44:14+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-11T22:33:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiManager: code injection lets an authenticated user run commands","impact":"high","summary":"FortiManager, Fortinet's central management appliance for firewalls, has a code injection flaw in several 7.x and 8.0 releases, including FortiManager Cloud. A remote attacker with a valid login can run unauthorized code or commands on the device by sending crafted HTTP requests.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortimanager","fortinet","firewall-management","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker runs arbitrary code or commands on the appliance","analyst_note":"Confirm the vendor advisory and fixed versions for FortiManager 8.0.2, 7.6.8, 7.4.12 and 7.2.13 from Fortinet's PSIRT page; the sources here give no fix.","how_to_check":"- Identify your FortiManager and FortiManager Cloud version against the affected ranges: FortiManager `8.0.0` through `8.0.1`, `7.6.0` through `7.6.7`, `7.4.0` through `7.4.11`, `7.2.0` through `7.2.12`.\n- unknown for any other specific check; the sources do not name a file or setting to inspect.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-ranges"],"who_is_affected":"Organizations running FortiManager or FortiManager Cloud in the affected version ranges, which manage Fortinet firewalls for other devices. The attacker must hold valid credentials on the management interface, so exposure depends on who can log in. unknown whether any specific configuration is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000798,"input_tokens":4693,"output_tokens":657,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the vendor advisory and fixed versions for FortiManager 8.0.2, 7.6.8, 7.4.12 and 7.2.13 from Fortinet's PSIRT page; the sources here give no fix.","search":"'-126182':13A,16A '-2026':12A,15A '7':46B '7.2.0':100C '7.2.1':120C '7.2.12':102C,122C '7.4.0':96C '7.4.1':115C '7.4.11':98C,117C '7.6.0':92C,110C '7.6.7':94C,112C '8.0':49B '8.0.0':88C,105C '8.0.1':90C,107C 'allow':124C 'applianc':36B 'attack':56B,128C 'authent':7A,21B,127C 'central':34B 'cloud':53B,104C,109C,114C,119C 'code':3A,41B,64B,81C,82C,132C 'command':10A,66B,134C 'control':77C 'craft':72B,136C 'cve':11A,14A 'devic':69B 'execut':130C 'firewal':23B,38B 'firewall-manag':22B 'flaw':43B 'fortimanag':2A,25B,31B,52B,87C,91C,95C,99C,103C,108C,113C,118C 'fortimanager':17A,18A,19A,20A 'fortinet':1A,26B,32B,86C 'generat':79C 'host':29B 'http':73B,137C 'improp':76C 'includ':51B 'inject':4A,42B,83C 'let':5A 'login':60B 'manag':24B,35B 'may':123C 'releas':50B 'remot':55B,126C 'request':74B,138C 'run':9A,62B 'self':28B 'self-host':27B 'send':71B 'sever':45B 'unauthor':63B,131C 'user':8A 'valid':59B 'vendor':30B 'via':135C 'vulner':84C 'x':47B","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiManager or FortiManager Cloud (and FortiAnalyzer / FortiAnalyzer Cloud, per the same Fortinet advisory) in the listed versions. The attacker needs a valid login and sends crafted HTTP requests, so exposure depends on who can log in to the management interface. Fortinet notes the JSON API route applies when enabled (off by default). Versions at or above the fixed releases can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:44:14Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227","run_id":3647},"products":{"at":"2026-11-11T22:44:14Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227","run_id":3647},"how_to_check":{"at":"2026-11-11T22:44:14Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227","run_id":3647},"who_affected":{"at":"2026-11-11T22:44:14Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227","run_id":3647}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimanager"],"ptokens":["fortimanager"],"labels":["authenticated","firewallmanagement","fortimanager","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126182':13A,16A '-2026':12A,15A 'authent':7A 'code':3A 'command':10A 'cve':11A,14A 'fortimanag':2A 'fortimanager':17A,18A,19A,20A 'fortinet':1A 'inject':4A 'let':5A 'run':9A 'user':8A","search_b":"'7':46B '8.0':49B 'applianc':36B 'attack':56B 'authent':21B 'central':34B 'cloud':53B 'code':41B,64B 'command':66B 'craft':72B 'devic':69B 'firewal':23B,38B 'firewall-manag':22B 'flaw':43B 'fortimanag':25B,31B,52B 'fortinet':26B,32B 'host':29B 'http':73B 'includ':51B 'inject':42B 'login':60B 'manag':24B,35B 'releas':50B 'remot':55B 'request':74B 'run':62B 'self':28B 'self-host':27B 'send':71B 'sever':45B 'unauthor':63B 'valid':59B 'vendor':30B 'x':47B","search_c":"'7.2.0':100C '7.2.1':120C '7.2.12':102C,122C '7.4.0':96C '7.4.1':115C '7.4.11':98C,117C '7.6.0':92C,110C '7.6.7':94C,112C '8.0.0':88C,105C '8.0.1':90C,107C 'allow':124C 'attack':128C 'authent':127C 'cloud':104C,109C,114C,119C 'code':81C,82C,132C 'command':134C 'control':77C 'craft':136C 'execut':130C 'fortimanag':87C,91C,95C,99C,103C,108C,113C,118C 'fortinet':86C 'generat':79C 'http':137C 'improp':76C 'inject':83C 'may':123C 'remot':126C 'request':138C 'unauthor':131C 'via':135C 'vulner':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126182","severity":null,"published_at":"2026-11-11T22:17:17+00:00","modified_at":"2026-11-11T22:17:17+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126182:3647","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227","severity":null,"published_at":"2026-11-11T22:44:14+00:00","modified_at":"2026-11-11T22:44:14+00:00","first_seen_at":"2026-11-11T22:44:14+00:00","fetched_at":"2026-11-11T22:44:14+00:00","note":"Fortinet PSIRT FG-IR-26-227 (CVE-2026-126182) read: fixed 8.0.2/7.6.8/7.4.12/7.2.13, not known exploited, JSON API rpc-permit none workaround. X/community not searched; no PoC seen.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-227","https://fortiguard.fortinet.com/psirt/FG-IR-26-227","https://fortiguard.fortinet.com/psirt/FG-IR-26-227"]}],"documents":[{"id":129706,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227","title":"Fortinet FG-IR-26-227: Improper control of generation of code in GUI","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":129706,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227","title":"Fortinet FG-IR-26-227: Improper control of generation of code in GUI","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":129706,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227","title":"Fortinet FG-IR-26-227: Improper control of generation of code in GUI","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}