CVE-2026-106171: arbitrary command execution in fgfmsd daemon
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets
Other sources
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted packets. Impersonation of a Fortimanager cluster node requires possessing the node's certificate and private key.
— FortiGuard
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 8.0.1 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 8.0.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have high privileges and network access to the affected FortiManager or FortiManager Cloud instance. No user interaction is required.
Which releases are identified as affected?
The affected releases listed are FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, and FortiManager Cloud 7.6.2 through 7.6.6.
What is the potential impact after exploitation?
A high-privileged attacker may use specially crafted packets to escalate privileges. The supplied severity vector indicates integrity and availability can be impacted, while confidentiality is not affected.