{"id":"CVE-2026-126261","kind":"vulnerability","aliases":["CVE-2026-126261"],"related":[],"title":"Fortinet FortiManager: crafted FGFM packets let an unauthenticated attacker run commands","description":"A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets.","summary":"Fortinet FortiManager versions 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5 and 7.2.0 through 7.2.8 have an improper authorization flaw in the FGFM port handling. An unauthenticated attacker who can reach that port may execute code or commands on the device by sending crafted FGFM packets.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["fgfm-port-not-reachable","version-outside-ranges"],"how_to_check":"- Check the installed FortiManager version in the admin interface or with `get system status` on the appliance.\n- Check whether the FGFM port (TCP 541) is reachable from untrusted networks.","fix":"- Move FortiManager to a release newer than the affected ranges listed above (8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, 7.2.0 through 7.2.8); the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-10T23:17:20+00:00","first_seen_at":"2026-11-10T23:27:36+00:00","triaged_at":"2026-11-10T23:28:46+00:00","updated_at":"2026-11-10T23:28:46+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T23:28:46Z","model":"claude-haiku-5-5","output":{"fix":"- Move FortiManager to a release newer than the affected ranges listed above (8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, 7.2.0 through 7.2.8); the exact fixed version is unknown from the sources.","reach":"network","title":"Fortinet FortiManager: crafted FGFM packets let an unauthenticated attacker run commands","impact":"high","summary":"Fortinet FortiManager versions 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5 and 7.2.0 through 7.2.8 have an improper authorization flaw in the FGFM port handling. An unauthenticated attacker who can reach that port may execute code or commands on the device by sending crafted FGFM packets.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortimanager","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker executes code or commands on the FortiManager appliance.","analyst_note":"Confirm the fixed version and any vendor advisory (Fortinet PSIRT) for CVE-2026-126261; the NVD entry alone does not state a fix.","how_to_check":"- Check the installed FortiManager version in the admin interface or with `get system status` on the appliance.\n- Check whether the FGFM port (TCP 541) is reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-ranges","fgfm-port-not-reachable"],"who_is_affected":"Organizations running FortiManager in the listed version ranges where the FGFM port is reachable by an attacker, such as from the internet or an untrusted network segment. Deployments that restrict FGFM access to managed FortiGate devices on a trusted network are at lower exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000821,"input_tokens":4596,"output_tokens":722,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126261':14A,17A '-2026':13A,16A '7.2.0':35B,86C '7.2.8':37B,88C '7.4.0':31B,82C '7.4.5':33B,84C '7.6.0':28B,78C '7.6.7':30B,80C '8.0.0':27B,76C 'allow':90C 'attack':9A,50B,93C 'author':41B,71C 'code':58B,102C 'command':11A,60B,104C 'craft':3A,66B,106C 'cve':12A,15A 'devic':63B 'execut':57B,101C 'fgfm':4A,45B,67B,98C,107C 'flaw':42B 'fortimanag':2A,18B,25B,75C,77C,81C,85C 'fortinet':1A,19B,24B,74C 'handl':47B 'host':23B 'improp':40B,70C 'infrastructur':20B 'let':6A 'may':56B,89C 'packet':5A,68B,108C 'port':46B,55B,99C 'reach':53B,96C 'run':10A 'self':22B 'self-host':21B 'send':65B 'unauthent':8A,49B,92C 'version':26B 'via':105C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiManager in the listed version ranges where the FGFM port is reachable by an attacker, such as from the internet or an untrusted network segment. Deployments that restrict FGFM access to managed FortiGate devices on a trusted network are at lower exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","fortimanager","fortinet","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126261':14A,17A '-2026':13A,16A 'attack':9A 'command':11A 'craft':3A 'cve':12A,15A 'fgfm':4A 'fortimanag':2A 'fortinet':1A 'let':6A 'packet':5A 'run':10A 'unauthent':8A","search_b":"'7.2.0':35B '7.2.8':37B '7.4.0':31B '7.4.5':33B '7.6.0':28B '7.6.7':30B '8.0.0':27B 'attack':50B 'author':41B 'code':58B 'command':60B 'craft':66B 'devic':63B 'execut':57B 'fgfm':45B,67B 'flaw':42B 'fortimanag':18B,25B 'fortinet':19B,24B 'handl':47B 'host':23B 'improp':40B 'infrastructur':20B 'may':56B 'packet':68B 'port':46B,55B 'reach':53B 'self':22B 'self-host':21B 'send':65B 'unauthent':49B 'version':26B","search_c":"'7.2.0':86C '7.2.8':88C '7.4.0':82C '7.4.5':84C '7.6.0':78C '7.6.7':80C '8.0.0':76C 'allow':90C 'attack':93C 'author':71C 'code':102C 'command':104C 'craft':106C 'execut':101C 'fgfm':98C,107C 'fortimanag':75C,77C,81C,85C 'fortinet':74C 'improp':70C 'may':89C 'packet':108C 'port':99C 'reach':96C 'unauthent':92C 'via':105C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T23:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126261","severity":null,"published_at":"2026-11-10T23:17:20+00:00","modified_at":"2026-11-10T23:17:20+00:00","first_seen_at":"2026-11-10T23:27:36+00:00","fetched_at":"2026-11-10T23:27:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}