Unauthenticated FortiManager FGFM flaw allows code execution
Original title: FGFM elevation before registration password is verified
An attacker who can reach the FGFM port may run code before the registration password is verified; CVSS 9.0.
Fortinet revised FG-IR-26-275 on November 10. An improper authorization flaw in FortiManager FGFM may let an unauthenticated attacker who can reach the FGFM port execute code or commands with crafted FGFM packets, before the registration password is verified. Fortinet scores it CVSSv3 9.0. The snippet does not list versions, a fix, or known exploitation.
Unconfirmed: Affected versions, fixed releases, and whether the flaw is exploited are not stated.
- CVSSv3 score is 9.0.
- The attacker does not need to authenticate.
- The attacker must be able to reach the FGFM port.
- Advisory revised on November 10, 2026.
Impact: Unauthenticated code or command execution via FGFM
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
- Vendors
- Fortinet
- Products
- FortiManager
From the original article
CVSSv3 Score: 9. 0 An improper authorization vulnerability in FortiManager FGFM may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.