CVE-2026-126181: High severity vulnerability

Published Nov 11, 2026

Updated

A use of hard-coded credentials vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions may allow an adjacent-network authenticated attacker with user permission to join the FGFM configuration-sync mesh of the affected FortiGate deployment via the default pre-shared key.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.4.12
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.6.8
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 8.0.2

Event History

Nov 11, 2026

CVE Published

via MITRE·09:29 PM

Data Sourced

via MITRE·09:29 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FortiManager deployments are affected?

Affected versions are FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, and all FortiManager 7.2 versions.

What access does an attacker need to exploit this issue?

An attacker must be on an adjacent network and already have authenticated user-level permission. Exploitation involves using the default pre-shared key to join the FGFM configuration-sync mesh of an affected FortiGate deployment.

Are deployments using the default pre-shared key exposed?

Yes. The described attack relies on the default pre-shared key, so affected deployments whose FGFM configuration-sync mesh still uses that key are exposed to an adjacent-network attacker with the required user permission.

CVE-2026-126181: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

Which FortiManager deployments are affected?

What access does an attacker need to exploit this issue?

Are deployments using the default pre-shared key exposed?

Company

Resources

Contact

Frequently Asked Questions

Which FortiManager deployments are affected?

What access does an attacker need to exploit this issue?

Are deployments using the default pre-shared key exposed?