High severity8.4NVD Advisory· Published Nov 11, 2026
CVE-2026-126180
CVE-2026-126180
Description
A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a low privileged Device Manager admin to obtain super admin privilege on managed FortiGates via injecting malicious commands.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, 7.2, Cloud 8.0.0 through 8.0.1, Cloud 7.6.0 through 7.6.7, Cloud 7.4.1 through 7.4.11, Cloud 7.2
Patches
Vulnerability mechanics
References
1News mentions
1- Improper neutralization of special elements used in a template engine iFortinet PSIRT · Nov 10, 2026