FGFM elevation before registration password is verified
FG-IR-26-275
Summary
CVSSv3 Score:
7.2
An External Control of File Name or Path vulnerability [CWE-22] and an Improper Neutralization of Special Elements vulnerability [CWE-74] in FortiManager, FortiManager Cloud, FortiAnalyzer, and FortiAnalyzer Cloud may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI.
Revised on 2026-11-10 00:00:00
Products covered
FortiManager
FortiManager Cloud
FortiAnalyzer
FortiAnalyzer Cloud
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 3
Updates
- Published by Fortinet
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.