[ CVE-2026-106171 · Published 13 Oct 2026 ]
Vulnerability in Fortinet FortiManager
CVSS 6.1
EPSS <1%2 agency advisoriesFix available
[ Description ]Official description
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets
[ Fixes ]Fixes and patches
- Security bulletin: Fortinet FG-IR-26-176Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-176, cited by CERT-FR CERTFR-2026-AVI-1306
- Security bulletin: Fortinet FG-IR-26-177Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-177, cited by CERT-FR CERTFR-2026-AVI-1306
- Security bulletin: Fortinet FG-IR-26-182Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-182, cited by CERT-FR CERTFR-2026-AVI-1306
- Security bulletin: Fortinet FG-IR-26-179Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-179, cited by CERT-FR CERTFR-2026-AVI-1306
- Security bulletin: Fortinet FG-IR-26-178Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-178, cited by CERT-FR CERTFR-2026-AVI-1306
- Security bulletin: Fortinet FG-IR-26-185Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-185, cited by CERT-FR CERTFR-2026-AVI-1306
- Security bulletin: Fortinet FG-IR-26-181Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-181, cited by CERT-FR CERTFR-2026-AVI-1306
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1306
Multiple vulnerabilities in Fortinet products Translated from French
Multiple vulnerabilities have been discovered in Fortinet products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
BSI CERT-BundWID-SEC-2026-3939
Fortinet FortiManager: Vulnerability allows privilege escalation Translated from German