FortiManager template injection can grant super admin on FortiGates
Original title: Improper neutralization of special elements used in a template engine i
Fortinet rates the command-injection path CVSS 8.4; the notice does not name versions, fixes or active attacks.
Fortinet says a template-engine flaw in FortiManager and FortiManager Cloud lets a low-privileged Device Manager administrator inject malicious commands. Successful use can yield super admin privilege on managed FortiGate devices. Advisory FG-IR-26-225 was revised on November 10. Versions and patches are not included in the snippet.
Unconfirmed: Affected versions, fixes, CVE identifiers and exploitation status are not stated.
- The weakness is CWE-1336 template injection.
- Fortinet identifies the advisory as FG-IR-26-225.
- Only a Device Manager admin role is required.
- The gained privilege applies to managed FortiGate devices.
Impact: low-privilege admin gains super admin on FortiGates
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiManager Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 8. 4 An Improper Neutralization of Special Elements Used in a Template Engine vulnerability [CWE-1336] in FortiManager and FortiManager Cloud may allow a low privileged Device Manager admin to obtain super admin privilege on managed FortiGates via injecting malicious commands. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.