OS Command Injection Vulnerability in Fortinet FortiManager Products
CVE-2026-106171

5.3MEDIUM

Key Information:

Vendor

Fortinet
Status
Fortimanager
Fortimanager Cloud
Vendor
CVE Published:
13 October 2026

What is CVE-2026-106171?

An OS command injection vulnerability exists in Fortinet FortiManager products that could potentially be exploited by an attacker. By sending specially crafted packets, an attacker may achieve unauthorized privilege escalation. This flaw affects various versions of FortiManager, including 8.0.0 and 7.6.0 through 7.6.6, as well as FortiManager Cloud versions from 7.6.2 to 7.6.6. Organizations using these affected products should assess their security posture and apply any necessary patches as recommended by the vendor.

Affected Version(s)

FortiManager 8.0.0

FortiManager 7.6.0 <= 7.6.6

FortiManager Cloud 7.6.2 <= 7.6.6

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-177

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.