An unauthenticated attacker who can reach the FGFM port may execute unauthorized code or commands by sending crafted FGFM packets.Fortinet scores the flaw 9.0 Critical, while the NVD record displays a Fortinet-sourced CVSS 3.1 score of 9.8 Critical. Both records describe a network attack requiring no privileges or user interaction.
What it allows
How Can CVE-2026-126261 Affect FortiManager?
The flaw is an improper authorization weakness in FortiManager FGFM. Fortinet says an attacker must be able to reach the FGFM port, which creates the network path needed to target the vulnerable component.
The attacker does not need authentication or help from another user. Crafted FGFM packets may then trigger execution of unauthorized code or commands on the FortiManager system.
The published CVSS vector records low attack complexity and high confidentiality, integrity, and availability impacts. Teams can review the broader consequences in our remote code execution overview.
Is CVE-2026-126261 Known to Be Exploited?
Fortinet marked CVE-2026-126261 as Known Exploited: No on November 10, 2026. The CVE was also absent from CISA's Known Exploited Vulnerabilities catalog version 2026.11.10.
Brandefense Blackhole recorded two Telegram posts mentioning this CVE during the 90 days ending November 11. This limited chatter is a monitoring signal, not evidence that exploitation succeeded.
Fortinet provides no virtual patch for this issue. Defenders should therefore treat the fixed software releases as the primary remediation path.
Who is affected
Which FortiManager Versions Are Affected by CVE-2026-126261?
FortiManager 8.0.0 is affected and is fixed in 8.0.1 or later. FortiManager 7.6.0 through 7.6.7 are affected and are fixed in 7.6.8 or later.
FortiManager 7.4.0 through 7.4.5 are affected and are fixed in 7.4.6 or later. FortiManager 7.2.0 through 7.2.8 are affected and are fixed in 7.2.9 or later.
Administrators should map every appliance to its release branch before scheduling the upgrade. The vulnerability management process should record the installed build and confirm the post-upgrade version.
This issue concerns FortiManager's FGFM component. Teams reviewing the product's history can compare it with the separate CVE-2024-47575 FortiManager profile.
Timeline
- 2026-11-10
Fortinet published FG-IR-26-275 with affected FortiManager branches, fixed releases, and a Known Exploited status of No.
- 2026-11-10
NVD published CVE-2026-126261 and displayed a Fortinet-sourced CVSS 3.1 score of 9.8 Critical.
- 2026-11-11
GitHub published its advisory database entry for CVE-2026-126261.
What to do
-
Upgrade the affected FortiManager branch
Install 8.0.1, 7.6.8, 7.4.6, or 7.2.9 and later, according to the deployed branch. Confirm the running build after maintenance.
-
Inventory every FortiManager deployment
Identify systems on 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, or 7.2.0 through 7.2.8. Include standby and disaster recovery systems.
-
Restrict access to the FGFM port
Brandefense recommends limiting the FGFM port to required management paths and trusted devices. The advisory identifies reachability to this port as an attack prerequisite.
-
Review management-plane activity
Brandefense recommends reviewing FortiManager and network telemetry for unexpected FGFM connections, commands, or configuration changes. Preserve evidence when activity warrants investigation.
What Brandefense can do
- Watch your stack for exploited flaws
Name the vendors and products you run, and Brandefense alerts you when a CVE in them is exploited.
- See CVE-2026-126261 in Brandefense Atlas
The Atlas record of CVE-2026-126261: severity, exploitation status and the sources behind it.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-126261?
It is a critical improper authorization vulnerability in FortiManager FGFM. An unauthenticated attacker who can reach the FGFM port may execute unauthorized code or commands.
Which FortiManager versions are affected by CVE-2026-126261?
Affected releases are 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8.
Which FortiManager versions fix CVE-2026-126261?
Fortinet lists 8.0.1, 7.6.8, 7.4.6, and 7.2.9 or later as fixed releases for their respective branches.
Is CVE-2026-126261 actively exploited?
Fortinet marked Known Exploited as No on November 10, 2026. The CVE was absent from CISA KEV catalog version 2026.11.10.
Why are two CVSS scores shown for CVE-2026-126261?
Fortinet's advisory gives CVSS 3.1 9.0 Critical. NVD displays 9.8 Critical and attributes that score and vector to Fortinet.
Sources
- FG-IR-26-275: Improper Authorization in FortiManager FGFMFortinet PSIRT
- CVE-2026-126261 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
- GHSA-952j-p3c7-fpqxGitHub Advisory Database
