Fortinet has fixed a critical security flaw in FortiManager that allows an attacker to run code on the system without logging in. The vulnerability, tracked as CVE-2026-126261, was published on 10 November 2026 as part of one of Fortinet's largest security updates in years, and administrators are being urged to patch now.

The flaw sits in the FortiGate-to-FortiManager (FGFM) protocol, the channel FortiManager uses to communicate with the FortiGate firewalls it manages. Because FortiManager controls whole fleets of firewalls from one console, a successful attack could hand an intruder the keys to an organisation's entire network perimeter.

What CVE-2026-126261 does

Fortinet describes the bug as an improper authorisation weakness in the FGFM service. An unauthenticated attacker who can reach the FGFM port can send specially crafted FGFM packets and execute code or commands on the FortiManager system. The weakness is that the authorisation check happens before the device registration password is verified, so no credentials are needed at all.

The vulnerability is rated CVSS 9.0, putting it in the critical range. It affects FortiManager versions 8.0.0, 7.6.0 to 7.6.7, 7.4.0 to 7.4.5 and 7.2.0 to 7.2.8. Fortinet has released fixed versions 8.0.1, 7.6.8, 7.4.6 and 7.2.9, and says there is no virtual patch and no workaround listed for this flaw.

Importantly, Fortinet says the flaw was not known to be exploited when the advisory was published, and it had not appeared in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue as of 11 November. That is reassuring, but FortiManager flaws have a history of being targeted quickly once details circulate, so the window for patching should not be treated as generous.

Part of a much bigger Fortinet patch wave

CVE-2026-126261 was one of around 89 advisories Fortinet published on 10 November, covering nearly 100 vulnerabilities across its products. The batch also included critical flaws in FortiMail, an SQL injection flaw in FortiAnalyzer tracked as CVE-2026-126262 and rated CVSS 9.3, and a server-side request forgery flaw in FortiAnalyzer tracked as CVE-2026-126260 and rated CVSS 9.0.

Fortinet said the flaws were found internally, with CVE-2026-126261 discovered by Theo Leleu of the Fortinet product security team with the help of an AI model, Claude Mythos. The company has not published any victim count or incident report linked to the new flaws.

What administrators should do now

The first step is to check which FortiManager version is running and upgrade to a fixed release: 8.0.1, 7.6.8, 7.4.6 or 7.2.9, depending on the branch in use. Because there is no workaround, patching is the only fix.

The second step is to make sure the FGFM port is not reachable from the internet. The flaw can only be exploited by an attacker who can reach that port, so restricting FGFM access to trusted management networks sharply reduces the risk while patching is under way. The same applies to the other management and logging ports covered by the November batch.

Organisations that cannot patch immediately should treat exposed FortiManager systems as a priority risk, review access logs for unusual connections to the FGFM service, and plan the upgrade as an emergency change rather than waiting for the next maintenance window.

Sources: Fortinet PSIRT advisory FG-IR-26-275 and GBHackers.