Is CVE-2026-126183 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126183 being exploited in the wild.

How severe is CVE-2026-126183?

High severity, with a CVSS score of 8.7, published 11 November 2026.

Which products and versions are affected?

Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12; Fortinet FortiManager Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12; Fortinet FortiSASE-Sovereign 26.2 (all), 25.4 (all), 25.3 (all), 25 (all).

Is there a fix for CVE-2026-126183?

Yes: fixed in FortiManager 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiManager Cloud 8.0.2 or above, 7.6.8 or above, 7.4.13 or above (upcoming), 7.2.13 or above (migrate); FortiSASE-Sovereign 26.2 (remediated, not yet released), 25.4 and 25.3 (migrate to fixed release). Until then: If the JSON API is enabled on a profile, disable it by setting rpc-permit to none in the admin profile configuration. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126183 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-126183?

Check whether you run Fortinet FortiManager, Fortinet FortiManager Cloud or Fortinet FortiSASE-Sovereign at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126183: Fortinet FortiManager authorization bypass through user-controlled key

CVE-2026-126183 · Severity: high · CVSS 8.7 · Published 2026-11-11

FortiManager is a centralized management platform for Fortinet security devices. An authenticated attacker can exploit an authorization bypass flaw to execute commands outside their assigned permissions through the JSON API, potentially allowing unauthorized configuration changes or policy modifications across managed devices.

Technologies: Fortinet FortiManager, Fortinet FortiManager Cloud, Fortinet FortiSASE-Sovereign. Vendors: Fortinet.

Quick answers

Is CVE-2026-126183 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126183 being exploited in the wild.
How severe is CVE-2026-126183?: High severity, with a CVSS score of 8.7, published 11 November 2026.
Which products and versions are affected?: Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12; Fortinet FortiManager Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12; Fortinet FortiSASE-Sovereign 26.2 (all), 25.4 (all), 25.3 (all), 25 (all).
Is there a fix for CVE-2026-126183?: Yes: fixed in FortiManager 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiManager Cloud 8.0.2 or above, 7.6.8 or above, 7.4.13 or above (upcoming), 7.2.13 or above (migrate); FortiSASE-Sovereign 26.2 (remediated, not yet released), 25.4 and 25.3 (migrate to fixed release). Until then: If the JSON API is enabled on a profile, disable it by setting rpc-permit to none in the admin profile configuration. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126183 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-126183?: Check whether you run Fortinet FortiManager, Fortinet FortiManager Cloud or Fortinet FortiSASE-Sovereign at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiManager 8.0.2 or above, 7.6.8 or above, 7.4.12 or above, 7.2.13 or above; FortiManager Cloud 8.0.2 or above, 7.6.8 or above, 7.4.13 or above (upcoming), 7.2.13 or above (migrate); FortiSASE-Sovereign 26.2 (remediated, not yet released), 25.4 and 25.3 (migrate to fixed release)

If the JSON API is enabled on a profile, disable it by setting rpc-permit to none in the admin profile configuration.

Technical details

An Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability exists in FortiManager, FortiManager Cloud, and FortiSASE-Sovereign GUI and JSON API. An authenticated attacker can send specially crafted HTTP requests to execute commands beyond their assigned scope. The JSON API is disabled by default; when enabled, the vulnerability can be mitigated by disabling RPC permissions on the affected admin profile.

Affected products

Fortinet FortiManager 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12
Fortinet FortiManager Cloud 8.0.1, 7.6.0 through 7.6.7, 7.4.1 through 7.4.11, 7.2.1 through 7.2.12
Fortinet FortiSASE-Sovereign 26.2 (all), 25.4 (all), 25.3 (all), 25 (all)

Timeline

2026-11-10: disclosed
2026-11-11: advisory

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-228

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.