# FortiManager: FGFM access can allow execution without authentication Canonical: https://www.oktsec.com/radar/fortimanager-fgfm-cve-2026-126261 Publisher: Oktsec Language: en Published: 2026-11-13T02:18:43Z Updated: 2026-11-13T02:18:43Z Record reviewed: 2026-11-13T02:18:43Z Latest evidence check: 2026-11-13T02:18:43Z Disclosed: 2026-11-10 Fortinet’s CNA record describes code or command execution without authentication when an attacker can reach the FGFM port. Four FortiManager branches have corrections; the record does not establish active exploitation. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: Fortinet confirms unauthenticated execution through reachable FGFM and publishes fixes for four branches. The reviewed manufacturer record does not establish attacks; management reachability determines exposure. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: No login required - Vendor: Fortinet - Products: FortiManager - CVEs: CVE-2026-126261 ## Technical overview Fortinet’s manufacturer record for CVE-2026-126261 identifies improper authorization in FortiManager. Crafted FGFM packets can allow an unauthenticated attacker to execute code or commands if the management port is reachable. This condition does not imply that every deployment exposes the service to the Internet. The correction differs by branch: 8.0.1, 7.6.8, 7.4.6 and 7.2.9. Match the installed branch and verify the active software after the upgrade. The reviewed record does not establish exploitation in real attacks. Oktsec recommends restricting management connectivity and reviewing unexplained changes as complementary precautions. The correction is specific to FortiManager; it does not resolve the separate FortiClient advisory. ## Recommended response Upgrade to 8.0.1, 7.6.8, 7.4.6 or 7.2.9 or a later corrected release in the applicable branch. Restrict FGFM access to required management peers and verify the active version. Relevant to: Teams operating FortiManager 8.0, 7.6, 7.4 or 7.2. ## CVE attribution - CVE-2026-126261: Fortinet — FortiManager. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126261.json) ## Affected systems and fixes ### FortiManager 8.0 Affected: 8.0.0 Fixed release / action: 8.0.1 or later in this branch ### FortiManager 7.6 Affected: 7.6.0 through 7.6.7 Fixed release / action: 7.6.8 or later in this branch ### FortiManager 7.4 Affected: 7.4.0 through 7.4.5 Fixed release / action: 7.4.6 or later in this branch ### FortiManager 7.2 Affected: 7.2.0 through 7.2.8 Fixed release / action: 7.2.9 or later in this branch Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-13T02:21:36.147Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-13T02:21:36.567Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-126261](https://api.first.org/data/v1/epss?cve=CVE-2026-126261): 0.78% probability of observed exploitation in the next 30 days; percentile 56.54%; score date 2026-11-12. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T02:21:36.567Z. ### Official regional advisories - [Vulnerabilidad en productos Fortinet](https://www.cert.gov.py/vulnerabilidad-en-productos-fortinet-8/) — CERT-PY, Paraguay; publication 2026-11-11T13:43:36.000Z; observed 2026-11-13T02:21:36.567Z; matched by exact CVE identifier. Publisher country does not establish victim location. Original notices may repeat the same underlying advisory. ## Response checklist 1. **Identify versions and FGFM reachability** — Check each FortiManager instance against the affected branch ranges. Determine which networks and hosts can reach FGFM; this is the access condition in Fortinet’s record. 2. **Install the correction for the running branch** — Use 8.0.1, 7.6.8, 7.4.6 or 7.2.9, or a later corrected release in that branch. Verify the active version after following the vendor’s upgrade procedure. 3. **Restrict management access and review activity** — Oktsec recommends limiting FGFM connectivity to necessary peers and reviewing unexplained management activity. Access restrictions reduce exposure but are not the software correction. ## Relevance to AI environments Oktsec recommends including this component in infrastructure inventories used by security automation; this vulnerability is not specific to AI. ## Sources - [Fortinet CNA record: FGFM prerequisite and four branch corrections](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126261.json) — Fortinet (CNA record); Vendor notice; checked 2026-11-13T02:13:42Z ## Editorial record - 2026-11-13T02:18:43Z: Added verified affected versions, branch corrections and the conditions described by the publisher. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/fortimanager-fgfm-cve-2026-126261) · [Build a response plan](https://www.oktsec.com/radar/fortimanager-fgfm-cve-2026-126261#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=fortimanager-fgfm-cve-2026-126261&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=fortimanager-fgfm-cve-2026-126261&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.