CRITICALVulnerability
Verified
Global

Critical Fortinet FortiManager Flaw Enables Managed Firewall Takeover

·Source: Fortinet PSIRT / Mandiant

Updated:

Executive Summary

CVE-2026-48788 allows registration of rogue FortiGate devices to FortiManager, enabling config push to entire managed firewall estate.

Analysis

Unauthenticated attackers can register rogue FortiGate devices and push malicious configs to all managed firewalls. CVSS 9.8. Mandiant links exploitation to UNC3886 deploying firmware implants surviving factory resets. Patch immediately and audit device registrations.

Timeline

Discovered
Mar 10, 2026
Exploitation Detected
Mar 12, 2026
Published
Mar 21, 2026
Patch Available
Mar 21, 2026

Indicators of Compromise (1)

CVE (1)
CVE-2026-48788
NVDMITRE CVE
Source Attribution

Originally published by Fortinet PSIRT / Mandiant on Mar 21, 2026. Verified by: CISA, Fortinet PSIRT, Mandiant.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-87115 — The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable...

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as

CVE-2026-87115
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-82042 — UTMStack before 11.2.16 contains an authentication bypass vulnerability that all...

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtai

CVE-2026-82042
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-82041 — UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMInc...

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user, regardless of role, can send arbitrary operating-system commands over gRPC to any connected agent, res

CVE-2026-82041
NIST NVD