Dashboard / CVE-2026-126218

CVE-2026-126218

HIGH
MEDIUM Priority: 0.04 BB Relevance: 62/100
Published: 2026-11-11 Modified: 2026-11-12 First seen: 2026-11-11 Status: active

Attack Surface

Network Low Complexity No Interaction Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Changed
C: Low
I: High
A: Low

Description

A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow a remote authenticated attacker with admin permission to elevate their privileges to root via crafted HTTP requests.

Weakness Classification (1)

Affected Software (6)

VendorProductVersion
Fortinet FortiManager 8.0.0
Fortinet FortiManager 7.6.0
Fortinet FortiManager 7.4.0
Fortinet FortiManager 8.0.0
Fortinet FortiManager 7.6.0
Fortinet FortiManager 7.4.0

References & Advisories (1)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.2 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L/E:P/RL:O/RC:C

EPSS — Exploitation Probability

0.53%
Raw Score 0.005280
Percentile 45.2%
Date 2026-11-12

Intelligence Sources

mitre ref →
nvd ref →

External Links