CVE-2026-126216: Low severity vulnerability
A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 8.0.2 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Who is able to exploit this issue?
Exploitation requires an authenticated administrator account. The attacker must be able to send specially crafted requests to the FortiManager or FortiManager Cloud GUI.
What could a successful attacker do?
A successful attacker may escalate privileges, bypass authorization controls, or impersonate internal services. The listed impact is limited to confidentiality and integrity; no availability impact is specified.
Which deployments should be checked?
Check FortiManager 8.0.0; 7.6.0 through 7.6.7; 7.4.0 through 7.4.11; and 7.2.0 through 7.2.12. Also check FortiManager Cloud 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, and 7.2.1 through 7.2.12.