CVE-2026-126216 · Infrastructure
NO FIX YET
Fortinet FortiManager has an improper privilege management flaw that lets an authenticated administrator escalate privileges, bypass authorization, or impersonate internal services through crafted GUI requests. The sources rate it low severity with CVSS 3.8 and do not say it is exploited.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running FortiManager on-premises or FortiManager Cloud within the listed version ranges. Exposure requires an authenticated administrator account, so the risk is mainly from insiders or compromised admin credentials. The sources do not say whether non-default settings are required.
Not affected if no-admin-accounts-exposed, unpatched-versions-outside-range
Who cares fortimanager, fortinet, self-hosted
get system status on the CLI, and compare it with the affected ranges: 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and FortiManager Cloud 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12.No fix yet, per the sources.
A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.