CVE-2026-126261

Summary

An improper authorization flaw in FortiManager allows unauthenticated attackers to send malicious FGFM protocol packets to execute arbitrary code or commands on vulnerable devices. This is critical because it enables remote code execution without authentication, bypassing expected access controls.

Exploitability

Exploitation requires network access to the FGFM port (typically TCP/541) and knowledge of the vulnerable FortiManager versions; no authentication is required.

Blast radius

Successful exploitation could lead to full system compromise including data exfiltration, lateral movement, and persistent backdoor installation across managed Fortinet devices.

Detection

Defenders should monitor for unusual FGFM traffic (TCP/541) from untrusted sources, especially with malformed or oversized packets, and correlate with FortiManager logs showing unexpected command execution events or FGFM session anomalies. No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to FortiManager 8.0.1 or later if currently on 8.0.0; upgrade to 7.6.8 or later if on 7.6.x; upgrade to 7.4.6 or later if on 7.4.x; upgrade to 7.2.9 or later if on 7.2.x.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.