Fortinet FortiManager: Improper authorization in FGFM allows code execution
Summary
FortiManager versions 8.0.0, 7.6.0 to 7.6.7, 7.4.0 to 7.4.5 and 7.2.0 to 7.2.8 contain an improper authorization flaw in the FGFM protocol, which FortiManager uses to manage connected FortiGate devices. An unauthenticated attacker who can reach the FGFM port can send crafted packets to execute code or commands on the device. The CVSS base score is 9.8 according to NVD and 9.0 according to Fortinet's advisory. Exploitation requires network access to the FGFM port, so exposure is the decisive factor.
Affected
- FortiManager 8.0.0
- FortiManager 7.6.0 to 7.6.7
- FortiManager 7.4.0 to 7.4.5
- FortiManager 7.2.0 to 7.2.8
- Note: the advisory ranges should be checked against the FG-IR-26-275 table, because an earlier Fortinet batch listed different 7.4 and 7.2 ranges.
Fixed in
- FortiManager 8.0.1 or above
- FortiManager 7.6.8 or above
- FortiManager 7.4.6 or above
- FortiManager 7.2.9 or above
- Secondary sources mention 8.0.2, 7.6.8, 7.4.12 and 7.2.13. Confirm the exact version in the Fortinet advisory before patching.
Workaround
Unknown. No vendor workaround for this CVE was confirmed. The fgfm-deny-unknown setting mentioned in other sources applies to CVE-2024-47575 and must not be assumed to cover this CVE.
Exploitation
- Fortinet's record does not list this CVE as known exploited.
- One secondary source reports the status as "Not exploited" and mentions a report from an anonymous party on 6 Nov 2026.
- No public proof of concept and no CISA KEV listing were found, but the KEV catalogue was not checked directly.
Our recommendation
- Identify all FortiManager and FortiAnalyzer instances and their versions.
- Restrict TCP 541 (FGFM) to known FortiGate addresses now, and block it from untrusted networks and the internet.
- Disable fgfm on interfaces that do not need it.
- Patch to the fixed version from the Fortinet advisory as soon as possible, and patch sibling FortiManager advisories published the same day together.
- Monitor for changes in exploitation status and check the NVD and CISA KEV entries regularly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fortinet PSIRT FG-IR-26-275 fortiguard.fortinet.com
- Fortinet PSIRT listing (FG-IR-26-275) fortiguard.fortinet.com
- Securityonline: Fortinet critical vulnerabilities, November 2026 securityonline.info
- CyberSecurityNews: Fortinet urges to patch critical flaws cybersecuritynews.com
- FortiManager 7.6.7 CLI Reference (allowaccess and fgfm) fortinetweb.s3.amazonaws.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:20.
Original description (NVD)
A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.