arbitrary command execution in fgfmsd daemon

FortiManager fgfmd command injection allows code execution only if the attacker already holds a cluster node key.

Fortinet PSIRT FG-IR-26-177 describes an OS command injection (CWE-78) in the FortiManager fgfmd daemon, scored CVSS 5.3. A remote attacker impersonating a FortiManager cluster node can execute unauthorized code or commands via crafted packets. Impersonation requires possession of that node's certificate and private key. The revised advisory states no CVE and no observed exploitation.

• CVSS 5.3 OS command injection (CWE-78) in FortiManager fgfmd
• Attacker must impersonate a cluster node using its certificate and private key
• Crafted packets can then execute unauthorized code or commands
• No CVE or in-the-wild exploitation is reported