CVE-2026-106171: OS Command Injection
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiManagerto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
Fortinet FortiManagerto a version that resolves this vulnerability.Fixed in 8.0.1 - Upgrade
Upgrade
Fortinet FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
Fortinet FortiManager Cloudto a version that resolves this vulnerability.Fixed in 8.0.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have high privileges and network access to the affected FortiManager or FortiManager Cloud instance. No user interaction is required.
Which releases are identified as affected?
The affected releases listed are FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, and FortiManager Cloud 7.6.2 through 7.6.6.
What is the potential impact after exploitation?
A high-privileged attacker may use specially crafted packets to escalate privileges. The supplied severity vector indicates integrity and availability can be impacted, while confidentiality is not affected.