FG-IR-26-177: arbitrary command execution in fgfmsd daemon

Q: What does an attacker need to exploit this issue?

The attacker must be able to impersonate a FortiManager cluster node. This requires possession of that node's certificate and private key, after which specially crafted packets may be used to execute unauthorized code or commands.

Q: Which products are identified as affected?

The issue is identified in Fortinet FortiManager and Fortinet FortiManager Cloud.

Published Oct 13, 2026

Updated

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted packets. Impersonation of a Fortimanager cluster node requires possessing the node's certificate and private key.

Affected Software

3 affected componentsFixes available

Fortinet FortiManager=.

Fortinet FortiManager>=7.6.0<=7.6.6

Fortinet FortiManager Cloud>=7.6.2<=7.6.6

Event History

Oct 13, 2026

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker must be able to impersonate a FortiManager cluster node. This requires possession of that node's certificate and private key, after which specially crafted packets may be used to execute unauthorized code or commands.

Which products are identified as affected?

The issue is identified in Fortinet FortiManager and Fortinet FortiManager Cloud.

FG-IR-26-177: arbitrary command execution in fgfmsd daemon

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which products are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which products are identified as affected?