Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-126261 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-11 |
| Vendor | Fortinet |
| Product | FortiManager |
| Vulnerability Type | improper authorization (CWE-285) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5 and FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets.
FGFM (FortiGate-to-FortiManager) is the protocol FortiGate devices use to communicate with FortiManager. Compromising FortiManager gives an attacker control over the configuration of every managed firewall — a similar scenario was exploited at scale with FortiJump (CVE-2024-47575).
Required Actions
- Update FortiManager to the version listed in Fortinet advisory FG-IR-26-275.
- Restrict access to the FGFM port (541/TCP by default) to the addresses of managed FortiGate devices only — it should not be reachable from the internet.
- Review the list of registered devices and FortiManager logs for unknown devices, unexpected configuration changes and scripts.
Who Is Affected?
The vulnerability affects Fortinet FortiManager 8.0.0, 7.6.0–7.6.7, 7.4.0–7.4.5 and 7.2.0–7.2.8. FortiManager is used to centrally manage FortiGate firewalls, including by managed service providers.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-126261 vulnerability?
CVE-2026-126261 is an improper authorization flaw (CWE-285) in Fortinet FortiManager that allows code or command execution via crafted FGFM packets. CVSS score: 9.8.
Does exploiting CVE-2026-126261 require authentication?
No. Network access to the FGFM port is enough; the attack requires no authentication or user interaction.
How to protect against CVE-2026-126261?
Update FortiManager as per advisory FG-IR-26-275 and restrict the FGFM port (541/TCP) to managed FortiGate devices.
Who is affected by CVE-2026-126261?
Organizations and managed service providers running FortiManager 8.0.0, 7.6.0–7.6.7, 7.4.0–7.4.5 or 7.2.0–7.2.8.
