CVE-2026-126213: SQL Injection
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted requests.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 8.0.2 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 8.0.2 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 8.0.2 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.6.8 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 8.0.2
Event History
Frequently Asked Questions
Does exploitation require user interaction or local access?
No. The vector is network-based and requires no user interaction, but the attacker must have low-privileged authenticated access.
What is the expected security impact if exploitation succeeds?
The vulnerability is rated high severity with high confidentiality impact and low availability impact. The integrity impact is rated as none.
How difficult is exploitation expected to be?
The attack complexity is rated low, and the exploit maturity is listed as proof-of-concept. Exploitation relies on specially crafted requests from an authenticated account.