{"id":"CVE-2026-126216","kind":"vulnerability","aliases":["CVE-2026-126216"],"related":[],"title":"Fortinet FortiManager: authenticated admins can escalate privileges via GUI","description":"A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.","summary":"Fortinet FortiManager has an improper privilege management flaw that lets an authenticated administrator escalate privileges, bypass authorization, or impersonate internal services through crafted GUI requests. The sources rate it low severity with CVSS 3.8 and do not say it is exploited.","severity":"low","cvss":3.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["no-admin-accounts-exposed","unpatched-versions-outside-range"],"how_to_check":"- Check the FortiManager version in the GUI or with `get system status` on the CLI, and compare it with the affected ranges: 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and FortiManager Cloud 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12.","fix":null,"status":"open","published_at":"2026-11-11T22:17:19+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:34:06+00:00","updated_at":"2026-11-11T22:34:06+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T22:34:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiManager: authenticated admins can escalate privileges via GUI","impact":"medium","summary":"Fortinet FortiManager has an improper privilege management flaw that lets an authenticated administrator escalate privileges, bypass authorization, or impersonate internal services through crafted GUI requests. The sources rate it low severity with CVSS 3.8 and do not say it is exploited.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Admin escalates privileges and impersonates internal services","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126216 to confirm the fixed versions and any required settings.","how_to_check":"- Check the FortiManager version in the GUI or with `get system status` on the CLI, and compare it with the affected ranges: 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and FortiManager Cloud 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unpatched-versions-outside-range","no-admin-accounts-exposed"],"who_is_affected":"Teams running FortiManager on-premises or FortiManager Cloud within the listed version ranges. Exposure requires an authenticated administrator account, so the risk is mainly from insiders or compromised admin credentials. The sources do not say whether non-default settings are required.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00081,"input_tokens":4702,"output_tokens":679,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-126216':12A,15A '-2026':11A,14A '3.8':55B '7.2.0':81C '7.2.1':101C '7.2.12':83C,103C '7.4.0':77C '7.4.1':96C '7.4.11':79C,98C '7.6.0':73C,91C '7.6.7':75C,93C '8.0.0':71C,86C '8.0.1':88C 'admin':4A 'administr':34B,108C 'allow':105C 'authent':3A,33B,107C 'author':38B,114C 'bypass':37B,113C 'cloud':85C,90C,95C,100C 'control':115C 'craft':44B,122C 'cve':10A,13A 'cvss':54B 'escal':6A,35B,110C 'exploit':62B 'flaw':29B 'fortimanag':2A,16B,23B,70C,72C,76C,80C,84C,89C,94C,99C 'fortinet':1A,17B,22B,69C 'gui':9A,45B,126C 'host':21B 'imperson':40B,117C 'improp':26B,64C 'infrastructur':18B 'intern':41B,118C 'let':31B 'low':51B 'manag':28B,66C 'may':104C 'privileg':7A,27B,36B,65C,112C 'rate':49B 'request':46B,123C 'say':59B 'self':20B 'self-host':19B 'servic':42B,119C 'sever':52B 'sourc':48B 'special':121C 'via':8A,120C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Teams running FortiManager on-premises or FortiManager Cloud within the listed version ranges. Exposure requires an authenticated administrator account, so the risk is mainly from insiders or compromised admin credentials. The sources do not say whether non-default settings are required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fortimanager","fortinet","infrastructure","low","selfhosted"],"campaign_type":null,"search_a":"'-126216':12A,15A '-2026':11A,14A 'admin':4A 'authent':3A 'cve':10A,13A 'escal':6A 'fortimanag':2A 'fortinet':1A 'gui':9A 'privileg':7A 'via':8A","search_b":"'3.8':55B 'administr':34B 'authent':33B 'author':38B 'bypass':37B 'craft':44B 'cvss':54B 'escal':35B 'exploit':62B 'flaw':29B 'fortimanag':16B,23B 'fortinet':17B,22B 'gui':45B 'host':21B 'imperson':40B 'improp':26B 'infrastructur':18B 'intern':41B 'let':31B 'low':51B 'manag':28B 'privileg':27B,36B 'rate':49B 'request':46B 'say':59B 'self':20B 'self-host':19B 'servic':42B 'sever':52B 'sourc':48B","search_c":"'7.2.0':81C '7.2.1':101C '7.2.12':83C,103C '7.4.0':77C '7.4.1':96C '7.4.11':79C,98C '7.6.0':73C,91C '7.6.7':75C,93C '8.0.0':71C,86C '8.0.1':88C 'administr':108C 'allow':105C 'authent':107C 'author':114C 'bypass':113C 'cloud':85C,90C,95C,100C 'control':115C 'craft':122C 'escal':110C 'fortimanag':70C,72C,76C,80C,84C,89C,94C,99C 'fortinet':69C 'gui':126C 'imperson':117C 'improp':64C 'intern':118C 'manag':66C 'may':104C 'privileg':65C,112C 'request':123C 'servic':119C 'special':121C 'via':120C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126216","severity":null,"published_at":"2026-11-11T22:17:19+00:00","modified_at":"2026-11-11T22:17:19+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}