arbitrary command execution in fgfmsd daemon

Summary by Cyber Security News13 Oct 2026, 09:00 CET

About this summary. This is a short excerpt from the description that Fortinet PSIRT published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://fortiguard.fortinet.com/psirt/FG-IR-26-177

CVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted packets. Impersonation of a Fortimanager cluster node requires possessing the node's certificate and private key. Revised on 2026-10-13 00:00:00

Read the full article at Fortinet PSIRT →