CVE-2026-126261
A NVD · · CVE-2026-126261
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 9.8
- EPSS
- 0%
Key insight
The decisive point is not the patch itself but that the attack vector is the FGFM management port: anyone leaving it reachable from the internet or untrusted networks exposes unauthenticated code execution on the central firewall management plane.
Description
FortiManager versions 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 contain an improper authorization flaw. An unauthenticated attacker able to reach the FGFM port (FortiGate-FortiManager protocol, default 541) can execute arbitrary code or commands on the device using crafted FGFM packets. Only FortiManager instances whose management interface is reachable by the attacker are affected; FortiGate devices themselves are not the vulnerability but depend on the compromiseable management plane. At the time of the NVD publication there is no information on active exploitation, CISA KEV listing, or a public proof of concept. The entry does not state a CVSS score or patch availability details.
Risk score
- cvss base
- 98.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 98.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational