---
id: "CVE-2026-126216"
page: "https://infrastack.ai/live/CVE-2026-126216"
kind: "vulnerability"
aliases: ["CVE-2026-126216"]
title: "Fortinet FortiManager: authenticated admins can escalate privileges via GUI"
severity: "low"
cvss: 3.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fortimanager", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["no-admin-accounts-exposed", "unpatched-versions-outside-range"]
published_at: "2026-11-11T22:17:19+00:00"
first_seen_at: "2026-11-11T22:29:30+00:00"
updated_at: "2026-11-11T22:34:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126216", "first_seen_at": "2026-11-11T22:29:30+00:00"}]
exploit_sources: []
---

# Fortinet FortiManager: authenticated admins can escalate privileges via GUI

Link for people: https://infrastack.ai/live/CVE-2026-126216 (this .md is for agents)

Fortinet FortiManager has an improper privilege management flaw that lets an authenticated administrator escalate privileges, bypass authorization, or impersonate internal services through crafted GUI requests. The sources rate it low severity with CVSS 3.8 and do not say it is exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FortiManager version in the GUI or with `get system status` on the CLI, and compare it with the affected ranges: 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and FortiManager Cloud 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12.

## Timeline

- 2026-11-11T22:29:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126216

## From the sources

A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_