Fortinet patches critical unauthenticated code-execution flaws in management products
CVE-2026-126170 scores 9.8 on the JSON-RPC API; FGFM and OFTP flaws can also run code before login.
78
CVE-2026-126261
Unauthenticated command execution in FortiManager via FGFM
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Fortinet FortiManager has an improper authorization flaw in its FGFM service. An unauthenticated attacker who can reach the FGFM port can send crafted FGFM packets and execute code or commands. Affected releases are 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8. Fortinet has not listed fixed builds.
What to do: Apply Fortinet's update for CVE-2026-126261. No workaround is stated.
| Product | Affected |
|---|---|
| Fortinet FortiManager | 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, 7.2.0 through 7.2.8 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets.
- Weakness
- CWE-285
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H