{"id":"CVE-2026-126218","kind":"vulnerability","aliases":["CVE-2026-126218"],"related":[],"title":"FortiManager: authenticated admin can escalate privileges to root via HTTP","description":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow a remote authenticated attacker with admin permission to elevate their privileges to root via crafted HTTP requests.","summary":"A flaw in Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7 and 7.4.0 through 7.4.11 lets a remote attacker who already has admin permission elevate their privileges to root. It is triggered by crafted HTTP requests.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiManager","fixed":["8.0.2","7.6.8","7.4.12"],"affected":">= 8.0.0, <= 8.0.1; >= 7.6.0, <= 7.6.7; >= 7.4.0, <= 7.4.11","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["admin-access-restricted","auth-required","versions-outside-range"],"how_to_check":"Run 'get system status' in the FortiManager CLI (or check System Settings > Dashboard in the GUI) and compare the version: affected are 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11. Also review which accounts hold admin permission.","fix":"Upgrade FortiManager 8.0.x to 8.0.2+, 7.6.x to 7.6.8+, 7.4.x to 7.4.12+. FortiManager 7.2 is not affected.","status":"open","published_at":"2026-11-11T22:17:19+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","triaged_at":"2026-11-11T22:31:37+00:00","updated_at":"2026-11-11T22:41:52+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-11T22:31:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FortiManager: authenticated admin can escalate privileges to root via HTTP","impact":"high","summary":"A flaw in Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7 and 7.4.0 through 7.4.11 lets a remote attacker who already has admin permission elevate their privileges to root. It is triggered by crafted HTTP requests.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimanager","fortinet","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker with admin login gains root on the FortiManager appliance","analyst_note":"Check Fortinet's PSIRT advisory for the fixed versions and any workaround; the NVD entry alone gives no fix.","how_to_check":"- Check the FortiManager version in the admin GUI or with `get system status` in the CLI, and compare it with the affected ranges.\n- Review who holds admin permission on FortiManager.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["versions-outside-range","admin-access-restricted"],"who_is_affected":"Organisations running FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7 or 7.4.0 through 7.4.11. Exposure needs an account with admin permission, so the risk is highest where admin access is shared widely or reachable from the internet. Installations on other versions are not in the stated ranges.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4585,"output_tokens":588,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Fortinet's PSIRT advisory for the fixed versions and any workaround; the NVD entry alone gives no fix.","search":"'-126218':13A,16A '-2026':12A,15A '7.4.0':39B,83C '7.4.11':41B,85C '7.6.0':35B,79C '7.6.7':37B,81C '8.0.0':32B,75C '8.0.1':34B,77C 'admin':3A,49B,93C 'allow':87C 'alreadi':47B 'attack':45B,91C 'auth':19B 'auth-requir':18B 'authent':2A,90C 'author':64C 'bypass':65C 'control':69C 'craft':60B,102C 'cve':11A,14A 'elev':51B,96C 'escal':5A 'flaw':28B 'fortimanag':1A,21B,31B,74C,78C,82C 'fortimanager':17A 'fortinet':22B,30B,73C 'host':26B 'http':10A,61B,103C 'infrastructur':23B 'key':70C 'let':42B 'may':86C 'permiss':50B,94C 'privileg':6A,53B,98C 'remot':44B,89C 'request':62B,104C 'requir':20B 'root':8A,55B,100C 'self':25B 'self-host':24B 'trigger':58B 'user':68C 'user-control':67C 'via':9A,101C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted FortiManager appliances or VMs on 8.0.0-8.0.1, 7.6.0-7.6.7 or 7.4.0-7.4.11. An attacker needs an existing admin-permission account and sends crafted HTTP requests to the GUI to reach root. Teams on 7.2 or already on the fixed versions can skip it; the risk is highest where many admins or restricted-profile admins exist.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:41:52Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-235","run_id":3641},"products":{"at":"2026-11-11T22:41:52Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-235","run_id":3641},"how_to_check":{"at":"2026-11-11T22:41:52Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-235","run_id":3641},"who_affected":{"at":"2026-11-11T22:41:52Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-235","run_id":3641}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortimanager"],"ptokens":["fortimanager"],"labels":["authrequired","fortimanager","fortinet","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126218':13A,16A '-2026':12A,15A 'admin':3A 'authent':2A 'cve':11A,14A 'escal':5A 'fortimanag':1A 'fortimanager':17A 'http':10A 'privileg':6A 'root':8A 'via':9A","search_b":"'7.4.0':39B '7.4.11':41B '7.6.0':35B '7.6.7':37B '8.0.0':32B '8.0.1':34B 'admin':49B 'alreadi':47B 'attack':45B 'auth':19B 'auth-requir':18B 'craft':60B 'elev':51B 'flaw':28B 'fortimanag':21B,31B 'fortinet':22B,30B 'host':26B 'http':61B 'infrastructur':23B 'let':42B 'permiss':50B 'privileg':53B 'remot':44B 'request':62B 'requir':20B 'root':55B 'self':25B 'self-host':24B 'trigger':58B","search_c":"'7.4.0':83C '7.4.11':85C '7.6.0':79C '7.6.7':81C '8.0.0':75C '8.0.1':77C 'admin':93C 'allow':87C 'attack':91C 'authent':90C 'author':64C 'bypass':65C 'control':69C 'craft':102C 'elev':96C 'fortimanag':74C,78C,82C 'fortinet':73C 'http':103C 'key':70C 'may':86C 'permiss':94C 'privileg':98C 'remot':89C 'request':104C 'root':100C 'user':68C 'user-control':67C 'via':101C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126218","severity":null,"published_at":"2026-11-11T22:17:19+00:00","modified_at":"2026-11-11T22:17:19+00:00","first_seen_at":"2026-11-11T22:29:30+00:00","fetched_at":"2026-11-11T22:29:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126218:3641","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-235","severity":null,"published_at":"2026-11-11T22:41:52+00:00","modified_at":"2026-11-11T22:41:52+00:00","first_seen_at":"2026-11-11T22:41:52+00:00","fetched_at":"2026-11-11T22:41:52+00:00","note":"Read Fortinet PSIRT FG-IR-26-235: fixes 8.0.2, 7.6.8, 7.4.12; 7.2 not affected; no workaround or virtual patch listed; not known exploited. No check written: version only, no repo-readable condition.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-235"]}],"documents":[{"id":129690,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-235","title":"FG-IR-26-235 FortiManager authorization bypass through user-controlled key","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}