CVE-2026-126261 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Fortinet FortiManager versions 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5 and 7.2.0 through 7.2.8 have an improper authorization flaw in the FGFM port handling. An unauthenticated attacker who can reach that port may execute code or commands on the device by sending crafted FGFM packets.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running FortiManager in the listed version ranges where the FGFM port is reachable by an attacker, such as from the internet or an untrusted network segment. Deployments that restrict FGFM access to managed FortiGate devices on a trusted network are at lower exposure.
Not affected if fgfm-port-not-reachable, version-outside-ranges
Who cares fortimanager, fortinet, self-hosted
get system status on the appliance.A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.