Fortinet FortiManager: Authorization Bypass (CVE-2026-126218)
CVE-2026-126218 is an authorization bypass vulnerability in FortiManager that allows a remote authenticated administrator to escalate privileges to root via crafted HTTP requests.
CVE search metadata
CVE search record: CVE-2026-126218. Severity: high. CVSS: 8.2. KEV: no. Product: FortiManager. Brief: Fortinet FortiManager: Authorization Bypass (CVE-2026-126218). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimanager-auth-bypass-cve-2026-126218/
Triage facts
Revision 1- Applicability
- FortiManager
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:21 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, and FortiManager 7.4.0 through 7.4.11 may allow a remote authenticated attacker with admin permission to elevate their privileges to root via crafted HTTP requests.
Impact
Successful exploitation allows an authenticated attacker with administrative permissions to elevate their privileges to root.