---
id: "CVE-2026-126261"
page: "https://infrastack.ai/live/CVE-2026-126261"
kind: "vulnerability"
aliases: ["CVE-2026-126261"]
title: "Fortinet FortiManager: crafted FGFM packets let an unauthenticated attacker run commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["fortimanager", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["fgfm-port-not-reachable", "version-outside-ranges"]
published_at: "2026-11-10T23:17:20+00:00"
first_seen_at: "2026-11-10T23:27:36+00:00"
updated_at: "2026-11-10T23:28:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126261", "first_seen_at": "2026-11-10T23:27:36+00:00"}]
exploit_sources: []
---

# Fortinet FortiManager: crafted FGFM packets let an unauthenticated attacker run commands

Link for people: https://infrastack.ai/live/CVE-2026-126261 (this .md is for agents)

Fortinet FortiManager versions 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5 and 7.2.0 through 7.2.8 have an improper authorization flaw in the FGFM port handling. An unauthenticated attacker who can reach that port may execute code or commands on the device by sending crafted FGFM packets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FortiManager version in the admin interface or with `get system status` on the appliance.
- Check whether the FGFM port (TCP 541) is reachable from untrusted networks.

## Fix

- Move FortiManager to a release newer than the affected ranges listed above (8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, 7.2.0 through 7.2.8); the exact fixed version is unknown from the sources.

## Timeline

- 2026-11-10T23:27:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126261

## From the sources

A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_