The vulnerability is an improper neutralization of special elements used in an OS command, which allows attackers to inject arbitrary command strings. This flaw can be triggered by specially crafted packets and provides a path for an adversary to execute OS commands, leading to privilege escalation on the affected FortiManager systems. The weakness is identified as CWE-78, a classic command injection issue that directly compromises the integrity and privileges of the system.

Fortinet FortiManager versions 8.0.0 and all 7.6.x releases from 7.6.0 through 7.6.6, as well as FortiManager Cloud versions 7.6.2 through 7.6.6 are affected. The upstream versions listed in the CPE data correspond to these product releases.

The CVSS score of 5.3 classifies the vulnerability as moderate, and the EPSS score is not available, meaning no current data on exploit likelihood. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network‑based attack where an attacker sends crafted packets to the FortiManager device. No mitigation barriers are indicated, so if the flaw is present, an attacker with network access could potentially achieve full system privileges.