Fortinet FortiManager: Template injection privilege escalation (CVE-2026-126180)
An improper neutralization of special elements in the template engine of FortiManager and FortiManager Cloud allows low-privileged Device Manager administrators to obtain super admin privileges on managed FortiGate devices via malicious command injection.
CVE search metadata
CVE search record: CVE-2026-126180. Severity: high. CVSS: 8.4. KEV: no. Product: FortiManager, FortiManager Cloud. Brief: Fortinet FortiManager: Template injection privilege escalation (CVE-2026-126180). Brief link: https://feed.craftedsignal.io/briefs/2026-11-fortinet-fortimanager-privilege-escalation-cve-2026-126180/
Triage facts
Revision 1- Applicability
- FortiManager, FortiManager Cloud
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 00:17 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-126180 describes a vulnerability in the template engine used by Fortinet FortiManager and FortiManager Cloud. The flaw allows an authenticated user with low-privileged Device Manager administrator rights to perform command injection, resulting in the acquisition of super admin privileges on managed FortiGate devices.
Impact
Successful exploitation allows a low-privileged Device Manager admin to obtain super admin privilege on managed FortiGates via injecting malicious commands.
Recommendation
Apply updates provided by the vendor for the affected versions: FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, and 7.2 (all versions); and FortiManager Cloud 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, and 7.2 (all versions).