CVE-2022-26116: SQL Injection
First published: Wed May 11 2022(Updated: )
Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiNAC | <=8.3.7 | |
| Fortinet FortiNAC | >=8.5.0<=8.5.2 | |
| Fortinet FortiNAC | >=8.6.2<=8.6.5 | |
| Fortinet FortiNAC | >=8.7.0<=8.7.6 | |
| Fortinet FortiNAC | >=8.8.0<=8.8.11 | |
| Fortinet FortiNAC | >=9.1.0<=9.1.5 | |
| Fortinet FortiNAC | >=9.2.0<=9.2.2 | |
| Fortinet FortiNAC | =8.5.4 | |
| Fortinet FortiNAC | =8.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-26116?
CVE-2022-26116 is a vulnerability in FortiNAC that allows an authenticated user to perform SQL injection attacks.
Which versions of FortiNAC are affected by CVE-2022-26116?
FortiNAC versions 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below are affected by CVE-2022-26116.
What is the severity of CVE-2022-26116?
CVE-2022-26116 has a severity rating of 8.8 (high).
How can an authenticated user exploit CVE-2022-26116?
An authenticated user can exploit CVE-2022-26116 by performing SQL injection attacks.
Is there a fix available for CVE-2022-26116?
Yes, Fortinet has released patches and updates to address the CVE-2022-26116 vulnerability. It is recommended to update to a fixed version of FortiNAC.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/tags
- agent/event
- agent/type
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/fortinet
- canonical/fortinet fortinac
- version/fortinet fortinac/8.3.7
- version/fortinet fortinac/8.5.0
- version/fortinet fortinac/8.5.2
- version/fortinet fortinac/8.6.2
- version/fortinet fortinac/8.6.5
- version/fortinet fortinac/8.7.0
- version/fortinet fortinac/8.7.6
- version/fortinet fortinac/8.8.0
- version/fortinet fortinac/8.8.11
- version/fortinet fortinac/9.1.0
- version/fortinet fortinac/9.1.5
- version/fortinet fortinac/9.2.0
- version/fortinet fortinac/9.2.2
- version/fortinet fortinac/8.5.4
- version/fortinet fortinac/8.6.0