CVE-2026-106171

Received Received - Intake

OS Command Injection in Fortinet FortiManager

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Fortinet, Inc.

Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106171

EUVD

EUVD-2026-98966

Affected Vendors & Products

Vendor	Product	Version / Range
Fortinet	FortiManager	8.0.0
Fortinet	FortiManager	7.6.0
Fortinet	FortiManager	Cloud 7.6.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is an OS command injection vulnerability in Fortinet FortiManager and FortiManager Cloud. It allows an attacker to execute unauthorized commands on the system by sending specially crafted packets. This could lead to privilege escalation if exploited successfully.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain higher privileges on the affected FortiManager system. This might lead to unauthorized access, data manipulation, or disruption of services managed by FortiManager.

Compliance Impact

This vulnerability allows privilege escalation via OS command injection, which could lead to unauthorized access or control of systems. Such breaches may violate compliance requirements under GDPR (data protection), HIPAA (health data security), or other regulations by exposing sensitive information or system integrity.

Mitigation Strategies

Upgrade FortiManager to a patched version. FortiManager 8.0.0 and 7.6.0 through 7.6.6 are affected. Apply the latest updates from Fortinet to address the OS command injection vulnerability.

Hi! I’m here to help you understand CVE-2026-106171. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70