Description
A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a low privileged Device Manager admin to obtain super admin privilege on managed FortiGates via injecting malicious commands.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiManager | 8.0.0 ≤8.0.1 | — |
| Fortinet | FortiManager | 7.4.0 ≤7.4.11 | — |
| Fortinet | FortiManager Cloud | 8.0.0 ≤8.0.1 | — |
| Fortinet | FortiManager | 7.6.0 ≤7.6.7 | — |
| Fortinet | FortiManager Cloud | 7.4.1 ≤7.4.11 | — |
| Fortinet | FortiManager | 7.2.0 ≤7.2.13 | — |
| Fortinet | FortiManager Cloud | 7.2.1 ≤7.2.13 | — |
| Fortinet | FortiManager Cloud | 7.6.0 ≤7.6.7 | — |
Advisories 2
- NCSC-2026-0488 Kwetsbaarheden verholpen in Fortinet FortiManager en FortiAnalyzer NCSC-NL (Netherlands) · Nov 12, 2026
- WID-SEC-2026-4489 Fortinet Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026