Authorization bypass through user-controlled key in dmserver

🚨SEVERITY: CRITICAL — CVSS 9.1Security Advisory

TL;DR 📌

  • CVSSv3 Score: 9.1 An Authorization Bypass Through User-Controlled Key [CWE-639] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud could allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests. Revised on 2026-11-10 00:00:00
  • Highest CVSS: 9.1 (Critical).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-126229.

What it is

CVE-2026-126229 is an authorization bypass through a user-controlled key (CWE-639) in dmserver, a component used across FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud.

The access path requires authentication: an attacker needs a valid administrator account on the platform. From there, by sending specially crafted HTTP requests to dmserver, they can reach and access other VDOMs (virtual domains) that their account should not have permission to see or manage. This is a privilege/scope escalation within the management plane rather than an unauthenticated remote code execution path — the flaw sits in how dmserver validates which VDOM a request is allowed to touch, likely trusting a key or identifier supplied in the request itself rather than independently verifying the caller’s assigned scope.

Fortinet rates this 9.1 (Critical). Given it affects both the on-premises FortiManager/FortiAnalyzer products and their Cloud equivalents, any deployment using VDOM separation for multi-tenant or departmental administration should treat this as relevant, since the core value of VDOMs — keeping administrators confined to their own domain — is what’s being bypassed.

The advisory does not list affected version ranges or fixed releases in the material available here, so version applicability and remediation builds should be confirmed directly against Fortinet’s advisory FG-IR-26-244.

What to do

  • Check FG-IR-26-244 directly for the exact affected version ranges and the fixed release for your platform (FortiManager, FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud) — this detail was not available in the summary used to produce this brief.
  • Until patched, review administrator accounts and their VDOM assignments; this bypass depends on having valid admin credentials, so tightening who holds admin access and enforcing least privilege on VDOM scope reduces the pool of accounts that could exploit it.
  • Audit recent administrator activity for VDOM access outside an account’s normal assigned scope — this is the practical indicator of misuse given the mechanism described.
  • Restrict management-plane access (HTTP/HTTPS admin interfaces on FortiManager/FortiAnalyzer) to trusted management networks only, and avoid exposing these interfaces directly to the internet.
  • Enforce strong authentication (MFA where supported) for all administrator accounts, since the attack requires only valid authentication, not a separate exploit for initial access.
  • Once Fortinet publishes fixed builds, prioritise upgrading FortiManager and FortiAnalyzer instances that use multiple VDOMs for tenant or department separation, as these deployments depend most on the isolation this flaw undermines.

For leadership 🧭

Executive summary. Any admin account on FortiManager, FortiAnalyzer or their Cloud equivalents can be used to break out of its assigned VDOM and reach domains it has no business touching, defeating the core isolation these products provide for multi-tenant or departmental management. Fortinet rates this 9.1 Critical; treat it as urgent for any deployment where separate teams or customers are kept apart by VDOMs.

Why it matters:

  • The flaw is in dmserver’s validation of which VDOM a request is allowed to touch, so an authenticated admin for one VDOM can craft HTTP requests to view or manage another administrator’s VDOM.
  • It affects both on-premises FortiManager/FortiAnalyzer and their Cloud equivalents, so hosted and self-managed estates are equally exposed.
  • The entire point of VDOM separation — keeping one team’s or tenant’s admin confined to their own domain — is exactly what this bypass defeats.
  • No affected version ranges or fixed releases are listed here, so exposure and patch status have to be confirmed directly against FG-IR-26-244 before anything can be ruled out.

Now / Next / Later:

  • Now: Pull up FG-IR-26-244 to confirm which FortiManager/FortiAnalyzer/Cloud versions you run are affected and whether a fixed build is already available.
  • Next: In the next change window, review all administrator accounts and their VDOM assignments, tighten them to least privilege, restrict admin HTTP/HTTPS access to trusted management networks, and apply the fixed release once confirmed.
  • Later: Build ongoing audit of administrator activity for cross-VDOM access and enforce MFA on all FortiManager/FortiAnalyzer admin accounts so a compromised or careless credential can’t be used to reach domains outside its scope.

Source