arbitrary command execution in fgfmsd daemon
CVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted packets. Impersonation of a Fortimanager cluster node requires possessing the node's certificate and private key. Revised on 2026-10-13 00:00:00
Read at Fortinet PSIRT Advisories
- Vendor
- Fortinet
- Product
- FortiManager / FortiAnalyzer
- CVSS v3.0
- 5.3
- Exposure class
- Network management
Why it ranks 22 (Routine)
- CVSS v3.0 5.3 medium
- Product class: network management
- Widely deployed vendor product (Fortinet)
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Fortinet PSIRT Advisories (fortiguard.fortinet.com)