---
id: "CVE-2026-126182"
page: "https://infrastack.ai/live/CVE-2026-126182"
kind: "vulnerability"
aliases: ["CVE-2026-126182"]
title: "Fortinet FortiManager: code injection lets an authenticated user run commands"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiManager", "fixed": ["7.2.13"], "affected": ">= 7.2.0, < 7.2.13", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["7.4.12"], "affected": ">= 7.4.0, < 7.4.12", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["7.6.8"], "affected": ">= 7.6.0, < 7.6.8", "ecosystem": "vendor"}, {"name": "FortiManager", "fixed": ["8.0.2"], "affected": ">= 8.0.0, < 8.0.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "firewall-management", "fortimanager", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["json-api-disabled", "versions-outside-ranges"]
published_at: "2026-11-11T22:17:17+00:00"
first_seen_at: "2026-11-11T22:29:30+00:00"
updated_at: "2026-11-11T22:44:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126182", "first_seen_at": "2026-11-11T22:29:30+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-227", "first_seen_at": "2026-11-11T22:44:14+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-227", "https://fortiguard.fortinet.com/psirt/FG-IR-26-227", "https://fortiguard.fortinet.com/psirt/FG-IR-26-227"]}]
exploit_sources: []
---

# Fortinet FortiManager: code injection lets an authenticated user run commands

Link for people: https://infrastack.ai/live/CVE-2026-126182 (this .md is for agents)

FortiManager, Fortinet's central management appliance for firewalls, has a code injection flaw in several 7.x and 8.0 releases, including FortiManager Cloud. A remote attacker with a valid login can run unauthorized code or commands on the device by sending crafted HTTP requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiManager affected >= 7.2.0, < 7.2.13 fixed 7.2.13
- vendor:FortiManager affected >= 7.4.0, < 7.4.12 fixed 7.4.12
- vendor:FortiManager affected >= 7.6.0, < 7.6.8 fixed 7.6.8
- vendor:FortiManager affected >= 8.0.0, < 8.0.2 fixed 8.0.2

## How to check

Check your FortiManager / FortiManager Cloud version (GUI dashboard or CLI 'get system status') against: 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12 (Cloud 7.4 and 7.2: from 7.4.1 and 7.2.1). Fortinet says the flaw can be exploited via the JSON API if enabled (disabled by default). Workaround from Fortinet: on each admin profile with it enabled, run 'config system admin profile' / 'edit <profile name>' / 'set rpc-permit none' / 'end'. Also check FortiAnalyzer (same advisory, same ranges) if you run it.

## Fix

Upgrade FortiManager and FortiManager Cloud to 8.0.2 (from 8.0.0-8.0.1), 7.6.8 (from 7.6.0-7.6.7), 7.4.12 (from 7.4.0-7.4.11) or 7.2.13 (from 7.2.0-7.2.12), or later. Same fixed versions for FortiAnalyzer and FortiAnalyzer Cloud.

## Timeline

- 2026-11-11T22:29:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126182
- 2026-11-11T22:44:14+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-227 — Fortinet PSIRT FG-IR-26-227 (CVE-2026-126182) read: fixed 8.0.2/7.6.8/7.4.12/7.2.13, not known exploited, JSON API rpc-permit none workaround. X/community not searched; no PoC seen.

## Documents

- [advisory] Fortinet FG-IR-26-227: Improper control of generation of code in GUI https://fortiguard.fortinet.com/psirt/FG-IR-26-227
- [fix] Fortinet FG-IR-26-227: Improper control of generation of code in GUI https://fortiguard.fortinet.com/psirt/FG-IR-26-227
- [mitigation] Fortinet FG-IR-26-227: Improper control of generation of code in GUI https://fortiguard.fortinet.com/psirt/FG-IR-26-227

## From the sources

A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_