Is CVE-2026-126180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126180 being exploited in the wild.

How severe is CVE-2026-126180?

High severity, with a CVSS score of 8.4, published 11 November 2026.

Which products and versions are affected?

Fortinet FortiManager 7.2 all versions, 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, 8.0.0 through 8.0.1; Fortinet FortiManager Cloud 7.2 all versions, 7.4.1 through 7.4.11, 7.6.0 through 7.6.7, 8.0.0 through 8.0.1.

Is there a fix for CVE-2026-126180?

Yes: fixed in FortiManager 7.4.12, 7.6.8, 8.0.2 or above; FortiManager Cloud 7.4.12, 7.6.8, 8.0.2 or above; FortiManager 7.2 and FortiManager Cloud 7.2 require migration to a fixed release. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126180 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-126180?

Check whether you run Fortinet FortiManager or Fortinet FortiManager Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126180: Fortinet FortiManager template injection privilege escalation

CVE-2026-126180 · Severity: high · CVSS 8.4 · Published 2026-11-11

FortiManager is a centralized management platform for Fortinet security devices. A template injection vulnerability allows low-privileged Device Manager administrators to execute malicious commands and gain super admin privileges on managed FortiGates, potentially compromising an organization's entire security infrastructure. This requires authentication but provides a direct path to complete administrative control.

Technologies: Fortinet FortiManager, Fortinet FortiManager Cloud. Vendors: Fortinet.

Quick answers

Is CVE-2026-126180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126180 being exploited in the wild.
How severe is CVE-2026-126180?: High severity, with a CVSS score of 8.4, published 11 November 2026.
Which products and versions are affected?: Fortinet FortiManager 7.2 all versions, 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, 8.0.0 through 8.0.1; Fortinet FortiManager Cloud 7.2 all versions, 7.4.1 through 7.4.11, 7.6.0 through 7.6.7, 8.0.0 through 8.0.1.
Is there a fix for CVE-2026-126180?: Yes: fixed in FortiManager 7.4.12, 7.6.8, 8.0.2 or above; FortiManager Cloud 7.4.12, 7.6.8, 8.0.2 or above; FortiManager 7.2 and FortiManager Cloud 7.2 require migration to a fixed release. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126180 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126180?: Check whether you run Fortinet FortiManager or Fortinet FortiManager Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiManager 7.4.12, 7.6.8, 8.0.2 or above; FortiManager Cloud 7.4.12, 7.6.8, 8.0.2 or above; FortiManager 7.2 and FortiManager Cloud 7.2 require migration to a fixed release

Technical details

An improper neutralization of special elements in a template engine (CWE-1336) in FortiManager's API allows authenticated Device Manager admins to inject malicious commands through template processing. The vulnerability affects versions 7.2 through 8.0.1 across both FortiManager and FortiManager Cloud. Exploitation results in privilege escalation to super admin on managed FortiGates.

Affected products

Fortinet FortiManager 7.2 all versions, 7.4.0 through 7.4.11, 7.6.0 through 7.6.7, 8.0.0 through 8.0.1
Fortinet FortiManager Cloud 7.2 all versions, 7.4.1 through 7.4.11, 7.6.0 through 7.6.7, 8.0.0 through 8.0.1

Timeline

2026-11-10: disclosed

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-225

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.