CVE-2026-106171 vulnerability in Fortinet Products
Published on October 13, 2026

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets

NVD

Vulnerability Analysis

Exploitation:

NONE

Automatable:

NO

Technical Impact:

TOTAL

Attack Vector:

ADJACENT_NETWORK

Attack Complexity:

LOW

Privileges Required:

HIGH

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

HIGH

Availability Impact:

HIGH

Weakness Type

What is a Shell injection Vulnerability?

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVE-2026-106171 has been classified to as a Shell injection vulnerability or weakness.

Products Associated with CVE-2026-106171

stack.watch emails you whenever new vulnerabilities are published in Fortinet FortiManager or Fortinet Fortimanagercloud. Just hit a watch button to start following.

Fortinet FortiManager

  Watch

Fortinet Fortimanagercloud

  Watch

Affected Versions

• Version 8.0.0 is affected.
• Version 7.6.0, <= 7.6.6 is affected.

• Version 7.6.2, <= 7.6.6 is affected.