{"id":"CVE-2026-126261","published":"2026-11-10T23:17:20.897","lastModified":"2026-11-10T23:17:20.897","description":"A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-285"],"vendors":[],"products":[],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-275","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An improper authorization flaw in FortiManager allows unauthenticated attackers to send malicious FGFM protocol packets to execute arbitrary code or commands on vulnerable devices. This is critical because it enables remote code execution without authentication, bypassing expected access controls.","exploitability":"Exploitation requires network access to the FGFM port (typically TCP/541) and knowledge of the vulnerable FortiManager versions; no authentication is required.","blast_radius":"Successful exploitation could lead to full system compromise including data exfiltration, lateral movement, and persistent backdoor installation across managed Fortinet devices.","remediation":"Upgrade to FortiManager 8.0.1 or later if currently on 8.0.0; upgrade to 7.6.8 or later if on 7.6.x; upgrade to 7.4.6 or later if on 7.4.x; upgrade to 7.2.9 or later if on 7.2.x.","detection":"Defenders should monitor for unusual FGFM traffic (TCP/541) from untrusted sources, especially with malformed or oversized packets, and correlate with FortiManager logs showing unexpected command execution events or FGFM session anomalies. No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","fgfm","network-exploit","ics"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:53:37.232Z"}}