Fortinet FortiManager: Improper neutralization of special elements (CVE-2026-126220)
CVE-2026-126220 is an injection vulnerability in Fortinet FortiManager that allows an authenticated administrator to perform arbitrary file operations or execute unauthorized code via crafted GUI requests.
CVE search metadata
CVE search record: CVE-2026-126220. Severity: high. CVSS: 7.2. KEV: no. Product: FortiManager. Brief: Fortinet FortiManager: Improper neutralization of special elements (CVE-2026-126220). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortimanager-cve-2026-126220/
Triage facts
Revision 1- Applicability
- FortiManager
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 02:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Fortinet FortiManager versions 8.0.0, 7.6.0 through 7.6.7, and 7.4.0 through 7.4.11 are affected by an improper neutralization of special elements in output used by a downstream component, categorized as an injection vulnerability. An authenticated administrator can leverage this flaw to read or write arbitrary files, or execute unauthorized code or commands by sending specifically crafted requests to the product GUI.
Impact
Successful exploitation allows an authenticated administrator to achieve unauthorized code execution or manipulate arbitrary files on the FortiManager appliance. The vulnerability is assigned a CVSS v3.1 base score of 7.2.
Recommendation
- Inventory all FortiManager instances to identify versions 8.0.0, 7.6.0-7.6.7, and 7.4.0-7.4.11.
- Monitor FortiManager GUI access logs for suspicious or anomalous request patterns initiated by administrative accounts.