Critical Fortinet FortiManager Flaw Enables Managed Firewall Takeover

Saturday, March 21, 2026 at 04:00 PM UTC·Source: Fortinet PSIRT / Mandiant

Updated: Sunday, March 22, 2026 at 12:00 PM UTC

Executive Summary

CVE-2026-48788 allows registration of rogue FortiGate devices to FortiManager, enabling config push to entire managed firewall estate.

Analysis

Unauthenticated attackers can register rogue FortiGate devices and push malicious configs to all managed firewalls. CVSS 9.8. Mandiant links exploitation to UNC3886 deploying firmware implants surviving factory resets. Patch immediately and audit device registrations.

Timeline

Discovered

Mar 10, 2026

Exploitation Detected

Mar 12, 2026

Published

Mar 21, 2026

Patch Available

Mar 21, 2026

Indicators of Compromise (1)

CVE (1)

CVE-2026-48788

NVD MITRE CVE

Source Attribution

Originally published by Fortinet PSIRT / Mandiant on Mar 21, 2026. Verified by: CISA, Fortinet PSIRT, Mandiant.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-108860 — BotSharp through 5.2.0 contains an authentication bypass vulnerability that allo...

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.

CVE-2026-108860

2h agoNIST NVD

MEDIUMVulnerability

The Luna Moth Files Weren’t Hacked. Here’s How They Leaked.

When asked about the “Luna Moth Files” that had mysteriously appeared online, Silent Ransom Group called them “fake” and insisted they hadn’t had any leak or breach. But they had. Here’s what we know. When the “Luna Moth Files” appeared on an onion site without anyone claiming responsibility or explaining their origin, DataBreaches asked a... Source

3h agoDataBreaches.net

CRITICALVulnerability

NVD CRITICAL: CVE-2026-108753 — Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability ...

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.

CVE-2026-108753

3h agoNIST NVD