Fortinet FortiManager FGFM improper authorization allows unauthenticated code execution (CVE-2026-126261)

What happened

Fortinet's advisory for FG-IR-26-275 describes an improper authorization weakness in the FortiManager FGFM component. An unauthenticated attacker who can reach the FGFM port over the network can send crafted FGFM packets to execute code or commands. The CVSS 3.1 base score is 9 (critical). The vector assumes a network attack path, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. Fortinet has not said the vulnerability has been exploited, and no public disclosure of exploit material is recorded.

Who is affected

Affected FortiManager versions are: 8.0.0; 7.6.0 through 7.6.7; 7.4.0 through 7.4.5; 7.2.0 through 7.2.8. The vulnerable condition is reachability of the FGFM port. If that port is reachable from beyond a trusted management network, the exposed instance should be treated as affected.

What to do now

1. Treat containment as the current priority: no fixed FortiManager release is listed yet, and Fortinet has not published a workaround.
2. Identify every FortiManager instance running 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, or 7.2.0 through 7.2.8.
3. Remove or restrict network access to the FGFM port so that only explicitly authorised FortiGate management traffic can reach it. Place it on a dedicated management network or behind access controls.
4. Monitor connections to the FGFM port for unexpected source addresses and review any reachability changes while waiting for Fortinet's fixed release.
5. Track Fortinet's FG-IR-26-275 advisory for a fixed version before planning a patch cycle.

How to detect it

Start with reachability: check whether the FGFM port on any affected FortiManager is reachable from outside the management network. Review firewall and routing rules for any path from untrusted networks to the FGFM port.

Beyond the patch

While the immediate work is containment, this class of issue is an exposure management problem first. An unauthenticated network path to a management protocol should have been visible and reduced before an advisory landed. Our Virtual CISO Services (vCISO) helps identify and close reachable management ports, and Supply Chain Defense & Third-Party Risk tracks the Fortinet software you run, the advisory cycle and the window in which you must rely on containment rather than a patch.