---
id: CVE-2026-106171
title: >-
  A improper neutralization of special elements used in an os command ('os
  command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager
  7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker
  to esc…
summary: >-
  A improper neutralization of special elements used in an os command ('os
  command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager
  7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker
  to esc…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-78
published: '2026-10-13'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T04:18:14.263'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106171'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-177'
    label: psirt@fortinet.com
tags:
  - nvd
ingestedAt: '2026-10-13T18:41:42.735Z'
---

## Overview

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.