FortiManager EUVD-2026-98966

Exploitation requires (1) an existing high-privilege administrative account on the FortiManager or FortiManager Cloud instance (CVSS PR:H) and (2) adjacent-network reachability to the management service (CVSS AV:A), from which the attacker sends specially crafted packets that trigger OS command injection. No user interaction is required (UI:N). The key limiting factors are the mandatory high-privilege authentication and the adjacent-network constraint - this is not remotely exploitable by an unauthenticated internet attacker, which substantially narrows realistic risk to post-compromise or malicious/compromised-operator scenarios. Affected: FortiManager 8.0.0 and 7.6.0-7.6.6, and FortiManager Cloud 7.6.2-7.6.6.

This is a moderate-risk issue that does not warrant emergency prioritization despite being in a high-value security appliance. The CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, base 6.1) is internally consistent and tells a coherent story: an attacker already holding high privileges (PR:H) on the adjacent network (AV:A) can leverage an OS command injection (CWE-78) to compromise integrity and availability (I:H/A:H) but not confidentiality (C:N). The two requirements - existing high-privilege access AND adjacent-network position - materially cap real-world exploitability, which is why the base score lands at Medium rather than Critical. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified; based on the available data this is 'no public exploit identified at time of analysis.' The signals are not conflicting - they consistently point to a privilege-escalation primitive usable only by an already-authenticated operator, i.e. a defense-in-depth / insider-or-post-compromise concern rather than a mass-exploitation network threat. Note the CVSS labels this 'escalation of privilege' yet scope is Unchanged (S:U) and confidentiality impact is N, which is slightly unusual for a privilege-escalation framing - treat the exact privilege boundary crossed as vendor-defined and verify against FG-IR-26-177.

An attacker who has already obtained a high-privilege administrative account on a FortiManager instance (or an adjacent-network foothold with such credentials) sends specially crafted packets to the management service, injecting operating-system commands that execute on the appliance. This lets them tamper with managed-device configurations and disrupt availability of the centralized management plane. No public exploit code was identified at time of analysis, and adjacent-network access plus high privileges are prerequisites.