Is your FortiManager exposed to CVE-2026-126261?
Fortinet published FG-IR-26-275 on 10 November 2026 for CVE-2026-126261, a Critical improper authorization vulnerability in FortiManager FGFM (CWE-285). Fortinet's CVSSv3 score is 9.0; the NVD record shows 9.8 on Fortinet's base vector. An unauthenticated attacker who can reach the FGFM port may execute code or commands. Fortinet lists Known Exploited: No, and no virtual patch. Upgrade to 8.0.1, 7.6.8, 7.4.6 or 7.2.9, or later.
Fortinet says it is not known exploited. Not in CISA KEV when checked on 11 November 2026
Fortinet advisory FG-IR-26-275 lists Known Exploited: No, and Virtual Patch: No. CVE-2026-126261 was not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 00:01 GMT on 11 November 2026 (catalogue 2026.11.10, released at 19:03 UTC on 10 November, before this advisory). Recheck KEV. Upgrade affected FortiManager 8.0.0 to 8.0.1 or above, 7.6.0 through 7.6.7 to 7.6.8 or above, 7.4.0 through 7.4.5 to 7.4.6 or above, and 7.2.0 through 7.2.8 to 7.2.9 or above. Those fixed builds were already released before this advisory was published.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 11 November 2026, 00:15 GMT.
At a Glance
Based on Fortinet advisory FG-IR-26-275, the official CVE and NVD records, Fortinet release-note change logs and port documentation, and CISA KEV, as of 11 November 2026. Last updated 11 November 2026, 00:15 GMT.
Critical, 9.0 and 9.8
Fortinet rates it Critical. FG-IR-26-275 and the official CVE record (CNA: Fortinet) list CVSSv3 9.0 on a vector that includes temporal metrics. In CVSS 3.1, E:U means Exploit Code Maturity: Unproven, which is separate from Fortinet's statement that it is not known to be exploited. The NVD record shows 9.8 on Fortinet's base vector. NVD had the record in Received status when we checked and had not published its own score.
Not known exploited
Fortinet lists Known Exploited: No. Not in CISA KEV when checked at 00:01 GMT on 11 November 2026 (catalogue 2026.11.10, which predates this advisory).
8.0.0, 7.6, 7.4 and 7.2 branches listed
FortiManager 8.0.0; 7.6.0 through 7.6.7; 7.4.0 through 7.4.5; and 7.2.0 through 7.2.8. The advisory lists only FortiManager, and only those branches. It does not list FortiManager Cloud or FortiAnalyzer; we make no claim about those products either way.
8.0.1, 7.6.8, 7.4.6 or 7.2.9+
Fortinet: upgrade to 8.0.1 or above, 7.6.8 or above, 7.4.6 or above, or 7.2.9 or above. No virtual patch is listed. These builds were already released before 10 November 2026. The release notes do not mention the CVE.
Fortinet's 7.2.9 change log lists the initial release of FortiManager 7.2.9.
Fortinet's 7.4.6 change log lists the initial release of FortiManager 7.4.6.
Fortinet's 8.0.1 change log lists the initial release of FortiManager 8.0.1.
Fortinet's 7.6.8 change log lists the initial release of FortiManager 7.6.8.
Fortinet publishes FG-IR-26-275 for CVE-2026-126261, rates it Critical, lists CVSSv3 9.0, and says Known Exploited: No. The official CVE record (CNA: Fortinet) is published the same day. This is not a same-day fix: the listed fixed builds were already out.
The NVD record is published, in Received status, and shows 9.8 on Fortinet's base vector. NVD has not scored it itself.
CVE-2026-126261 is not in CISA KEV catalogue 2026.11.10 (released at 19:03 UTC on 10 November, before this advisory). Recheck KEV.
Affected and fixed versions (FG-IR-26-275)
The table follows Fortinet's advisory exactly. Fortinet lists only FortiManager, and only these branches. It does not list FortiManager Cloud or FortiAnalyzer; we make no claim about those products either way. Scores: Fortinet CVSSv3 9.0 (vector with temporal metrics E:U/RL:O/RC:C). In CVSS 3.1, E:U means Exploit Code Maturity: Unproven, which is separate from Fortinet's statement that it is not known to be exploited. NVD shows 9.8 on the base vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD had the record in Received status when we checked at 00:01 GMT on 11 November 2026 and had not published its own score. The weakness is CWE-285 (Improper Authorization). Fortinet lists the component as GUI; we do not interpret that. Found internally by Fortinet's own Product Security team.
| Product (Fortinet) | Affected | Fortinet's solution |
|---|---|---|
| FortiManager 8.0 | 8.0.0 | Upgrade to 8.0.1 or above |
| FortiManager 7.6 | 7.6.0 through 7.6.7 | Upgrade to 7.6.8 or above |
| FortiManager 7.4 | 7.4.0 through 7.4.5 | Upgrade to 7.4.6 or above |
| FortiManager 7.2 | 7.2.0 through 7.2.8 | Upgrade to 7.2.9 or above |
Fortinet change logs give these initial release dates for the fixed builds: 7.2.9 on 12 December 2024, 7.4.6 on 18 December 2024, 8.0.1 on 15 September 2026, and 7.6.8 on 22 October 2026. The advisory was published on 10 November 2026, so the listed fixed builds shipped before the advisory. The release notes and resolved issues pages for those four builds do not mention CVE-2026-126261 or FG-IR-26-275. Fortinet does not say, beyond naming these versions, when the fix went in, and we make no further claim.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Vendor steps and our advice are labelled separately.
Upgrade FortiManager
- Fortinet: upgrade FortiManager 8.0.0 to 8.0.1 or above, 7.6.0 through 7.6.7 to 7.6.8 or above, 7.4.0 through 7.4.5 to 7.4.6 or above, and 7.2.0 through 7.2.8 to 7.2.9 or above. See FG-IR-26-275. Fortinet lists no virtual patch.
- Our advice: inventory every FortiManager you or your clients run, including VMs and lab systems, and record the exact version.
- Fortinet documentation (not the advisory): These port numbers come from Fortinet documentation, not from advisory FG-IR-26-275. Fortinet's FortiManager 8.0.0 Incoming ports page lists IPv4 FGFM management as TCP 541, and IPv6 FGFM management as TCP 541 starting in FortiManager 7.4.1 and TCP 542. The FortiGate/FortiManager Communications Protocol Guide says FGFM uses TCP 541 for IPv4, that FortiManager also supports IPv6 over TCP 542, and that FortiManager listens on TCP port 541.
- Our advice: restrict FGFM so only known FortiGate addresses can reach it, and do not leave it on the internet. That restriction is our advice, not a workaround in the advisory, and it does not replace the upgrade.
- Our advice: push the fixed build through your change process as soon as you can. The listed fixed versions were already released before this advisory.
Hunt and contain
- Our advice: Fortinet has published no indicators of compromise. Look for unexpected devices or FortiGate registrations on FortiManager, and for unexpected FGFM sessions. Pack queries Q2, Q2b, Q4, Q5, Q6, Q6b, Q7 and Q8 are our patterns.
- Our advice: look for unexpected configuration changes, policy installs or new administrator accounts on the FortiManager.
- Our advice: check whether the FGFM port is reachable from untrusted networks. The documented ports are in Fortinet's Incoming ports page and Communications Protocol Guide, not in the advisory.
- Our advice: if anything looks off, isolate the FortiManager, keep its logs, apply the fixed build, and rotate FortiManager credentials and any credentials it could reach.
Proactive: Vendor Steps, Then Ours
Fortinet's upgrade first, then Fortinet's port documentation, then our advice for inventory and access. Our advice is not a substitute for FG-IR-26-275.
Upgrade to the fixed FortiManager builds
Fortinet: upgrade affected 8.0.0 to 8.0.1 or above, 7.6.0 through 7.6.7 to 7.6.8 or above, 7.4.0 through 7.4.5 to 7.4.6 or above, and 7.2.0 through 7.2.8 to 7.2.9 or above. See Fortinet advisory FG-IR-26-275. Fortinet lists Virtual Patch: No, and does not publish a workaround.
Inventory every FortiManager
List every FortiManager appliance and VM, including lab and client-managed systems, with the exact version. The advisory lists only FortiManager, and only the 8.0, 7.6, 7.4 and 7.2 branches above. Follow that table. The checker reports unlisted branches as OUT OF RANGE and makes no claim about them, and we make no claim about FortiManager Cloud or FortiAnalyzer either way.
FGFM ports in Fortinet documentation
These port numbers come from Fortinet documentation, not from advisory FG-IR-26-275. Fortinet's FortiManager 8.0.0 Incoming ports page lists IPv4 FGFM management as TCP 541, and IPv6 FGFM management as TCP 541 starting in FortiManager 7.4.1 and TCP 542. The FortiGate/FortiManager Communications Protocol Guide says FGFM uses TCP 541 for IPv4, that FortiManager also supports IPv6 over TCP 542, and that FortiManager listens on TCP port 541.
Restrict who can reach FGFM
Our advice, not Fortinet's: restrict FGFM so only known FortiGate addresses can reach it, and do not expose FGFM to the internet. That restriction is not a workaround in the advisory, and it does not replace the upgrade.
Confirm the installed build
After upgrade, confirm the running version is 8.0.1, 7.6.8, 7.4.6 or 7.2.9, or a later build on the same branch, against Fortinet's advisory and release notes, not a marketing version string alone.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.
check-fortimanager.sh
Read-only, offline checker. It compares the FortiManager version you give it, or a CSV inventory, against Fortinet's listed ranges in FG-IR-26-275. It never contacts Fortinet or a device. Branches Fortinet did not list, including 7.0 and 6.x, are reported as OUT OF RANGE, with no claim that those branches are affected or not affected.
bash check-fortimanager.sh --version 7.4.5 --name fmg-01
bash check-fortimanager.sh --inventory fortimanager-inventory.csvCheck-FortiManager.ps1
The same checks in PowerShell 7, with identical output and exit codes. It also runs under PowerShell on Linux.
pwsh -File Check-FortiManager.ps1 -Inventory fortimanager-inventory.csvKQL and Sigma
12 KQL hunts for Microsoft Sentinel and Defender XDR (Q1, Q1b and Q1c are inventory; Q2, Q2b, Q3, Q4, Q5, Q6, Q6b, Q7 and Q8 are our patterns). 4 Sigma rules (net_firewall_fgfm_public_source.yml, fortimanager_fgfm_registration_peer_events.yml, fortimanager_script_shell_config_push.yml and win_net_fgfm_port_connection.yml). The hunts labelled our patterns are CybaVerse hunting ideas, not Fortinet guidance and not IOCs. Fortinet has published no indicators of compromise, and the pack contains none. Sentinel table and vendor strings, the log_id values, and the Q5 and Q6 keyword text are unverified. None of the KQL has been run against a live tenant. Three of the four Sigma rules convert only without a pipeline.
Verdicts
- PATCHEDAt or above Fortinet's fix in a listed branch (8.0.1, 7.6.8, 7.4.6 or 7.2.9).
- VULNERABLEIn Fortinet's listed affected ranges.
- OUT OF RANGEA branch Fortinet did not list (for example 7.0 or 6.x). No claim either way.
- UNKNOWNNot FortiManager, no product, no version, or an unreadable version. Never reported as PATCHED.
Exit codes
| Code | Meaning |
|---|---|
| 0 | Every row PATCHED |
| 1 | Any VULNERABLE |
| 2 | Any OUT OF RANGE, none vulnerable |
| 3 | Any UNKNOWN, none vulnerable or out of range |
| 4 | Usage or read error |
Inventory mode exits with the worst row. MSPs can use the exit code in RMM or scheduled jobs.
Know the limits
- Both checkers are read-only and offline. They only compare the versions or CSV you give them, send no network traffic, write nothing, and never contact Fortinet or a device. They report 7.0, 6.x and other unlisted branches as OUT OF RANGE, with no claim that those branches are affected or not affected.
- Q2, Q2b, Q3, Q4, Q5, Q6, Q6b, Q7 and Q8 are our own patterns, not Fortinet's. They do not detect the vulnerability itself. Q1, Q1b and Q1c are inventory.
- Sentinel table and vendor strings, the log_id values, and the Q5 and Q6 keyword text are unverified. None of the KQL has been run against a live tenant.
- Three of the four Sigma rules convert only without a pipeline. The Windows FGFM port rule converts on the Microsoft pipelines, with quirks documented in the README.
- Only FortiManager is listed in the advisory. The pack makes no claim about FortiManager Cloud or FortiAnalyzer either way.
What is in the pack
| File | What it does |
|---|---|
| check-fortimanager.sh | Offline checker for Linux and macOS (bash) |
| Check-FortiManager.ps1 | The same checker in PowerShell 7 |
| KQL (12 hunts) | Q1, Q1b and Q1c inventory; Q2, Q2b, Q3, Q4, Q5, Q6, Q6b, Q7 and Q8 our patterns |
| Sigma (4 rules) | net_firewall_fgfm_public_source.yml, fortimanager_fgfm_registration_peer_events.yml, fortimanager_script_shell_config_push.yml and win_net_fgfm_port_connection.yml, plus Kusto conversions (in the full pack) |
| tests/ | Fixtures and tests (in the full pack; 26 files in total) |
| README.md | Verified facts, Fortinet's advice versus ours, limits and usage |
Reactive: How to Hunt (Our Advice)
Fortinet has published no indicators of compromise, and the pack contains none. The hunts below, and pack queries Q2 to Q8, are CybaVerse advice, our own patterns. None of the KQL has been run against a live tenant. CybaOps can still run a hunt across your estate.
FGFM exposure and unexpected sessions
Check whether the FGFM port is reachable from untrusted networks. The port numbers themselves are from Fortinet's Incoming ports page and Communications Protocol Guide, not from the advisory. Look for unexpected FGFM sessions or FortiGate registrations that you cannot account for. Pack queries Q2, Q2b, Q3 and Q4 are our patterns for this.
Admin and configuration changes
Review FortiManager administrator accounts, policy package installs and configuration changes around the period the manager was running an affected build, especially any change you cannot tie to a known change window. Pack queries Q5, Q6, Q6b and Q7 are our patterns. The log_id values and the Q5 and Q6 keyword text are unverified.
Follow-on activity from the manager
Because FortiManager can push configuration and firmware to managed FortiGates, look for unexpected installs or policy changes on those devices as well if the manager looks suspicious. Pack query Q8 is our pattern for unusual outbound connections from the manager.
If you find signs of compromise (our advice)
- Isolate the FortiManager from untrusted networks and keep its logs and a configuration backup for investigation.
- Apply the fixed FortiManager build listed in FG-IR-26-275.
- Rotate FortiManager credentials, API tokens and any credentials the manager could reach, including those used to manage FortiGates.
- Review managed FortiGates for unexpected configuration or firmware changes.
- Start incident response if the manager sits in a path that can change production firewalls.
FortiManager CVE-2026-126261 FAQ
Short answers based on Fortinet advisory FG-IR-26-275, the official CVE and NVD records, Fortinet release-note change logs and port documentation, and CISA KEV, checked on 11 November 2026.
What is CVE-2026-126261?
Fortinet advisory FG-IR-26-275, published on 10 November 2026, is titled 'FGFM elevation before registration password is verified.' It describes an improper authorization vulnerability in FortiManager FGFM that may allow an unauthenticated attacker who can reach the FGFM port to execute code or commands via crafted FGFM packets. The official CVE record lists CWE-285 (Improper Authorization). Fortinet lists the component as GUI; we do not interpret that. Fortinet says it was found internally by Fortinet's own Product Security team. Only FortiManager is listed; FortiManager Cloud and FortiAnalyzer are not, and we make no claim about them either way.
How severe is it, and why do some records say 9.0 and others 9.8?
Fortinet rates it Critical. FG-IR-26-275 lists a CVSSv3 score of 9.0. The official CVE record (CNA: Fortinet) uses the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C, which includes temporal metrics, and a score of 9.0. In CVSS 3.1, E:U means Exploit Code Maturity: Unproven. That is separate from Fortinet's statement that the issue is not known to be exploited. The NVD record, which was in Received status when we checked on 11 November 2026, shows 9.8 on Fortinet's base vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD has not published its own score. We report both figures, with those sources, and do not invent a third score.
Is it being exploited, or is it in CISA KEV?
Fortinet lists Known Exploited: No. CVE-2026-126261 was not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 00:01 GMT on 11 November 2026 (catalogue 2026.11.10, released at 19:03 UTC on 10 November, before this advisory). That can change; recheck KEV. Fortinet's CVSS vector also includes E:U (Exploit Code Maturity: Unproven), which is a statement about exploit code maturity, not the same thing as 'not known to be exploited'.
Which versions are affected, and when were the fixes released?
Affected, per FG-IR-26-275: FortiManager 8.0.0; 7.6.0 through 7.6.7; 7.4.0 through 7.4.5; and 7.2.0 through 7.2.8. Fortinet's solution is 8.0.1 or above, 7.6.8 or above, 7.4.6 or above, and 7.2.9 or above. This is not a same-day patch. Fortinet change logs list these initial release dates: 7.2.9 on 12 December 2024, 7.4.6 on 18 December 2024, 8.0.1 on 15 September 2026, and 7.6.8 on 22 October 2026. The advisory itself was published on 10 November 2026. The release notes and resolved issues pages for those four builds do not mention the CVE. Fortinet does not say, beyond naming these versions, when the fix went in.
Is there a virtual patch or a vendor workaround?
Fortinet lists Virtual Patch: No, and the advisory does not publish a workaround. Fortinet's Incoming ports page and Communications Protocol Guide, which are not the advisory, document FGFM as TCP 541 for IPv4 and TCP 542 for IPv6 (with TCP 541 also listed for IPv6 starting in FortiManager 7.4.1). Our advice, not Fortinet's: restrict FGFM so only known FortiGate addresses can reach it, and do not leave it on the internet. That restriction does not replace the upgrade.
Who is this relevant to?
Organisations and MSPs that run FortiManager on the 8.0, 7.6, 7.4 or 7.2 branches listed in the advisory, including virtual appliances and lab systems, especially where the FGFM port is reachable from untrusted networks. Only FortiManager is listed. We make no claim about FortiManager Cloud or FortiAnalyzer either way, and the checker reports unlisted FortiManager branches such as 7.0 or 6.x as OUT OF RANGE, with no claim.
Protect Your FortiManager Estate, and Your Customers'
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- Fortinet advisory FG-IR-26-275: FGFM elevation before registration password is verified (published 10 November 2026)
- NVD: CVE-2026-126261 (Received; shows 9.8 on Fortinet's base vector; NVD has not scored it itself)
- Fortinet Document Library: FortiManager 8.0.1 release notes, change log (initial release 15 September 2026)
- Fortinet Document Library: FortiManager 7.6.8 release notes, change log (initial release 22 October 2026)
- Fortinet Document Library: FortiManager 7.4.6 release notes, change log (initial release 18 December 2024)
- Fortinet Document Library: FortiManager 7.2.9 release notes, change log (initial release 12 December 2024)
- Fortinet Document Library: FortiManager 8.0.0 Incoming ports (IPv4 FGFM TCP 541; IPv6 FGFM TCP 541 starting in 7.4.1, and TCP 542). This is port documentation, not the PSIRT advisory.
- Fortinet Document Library: FortiGate/FortiManager Communications Protocol Guide, protocol components (FGFM over TCP 541 for IPv4; IPv6 over TCP 542). This is not the PSIRT advisory.
- CISA: Known Exploited Vulnerabilities catalogue (checked 11 November 2026, 00:01 GMT; catalogue 2026.11.10, released 10 November 2026 at 19:03 UTC)
Related threat guides: FortiClient CVE-2026-121529 and all threat guides.