CVE-2026-23705: SQL Injection
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.4.8 - Upgrade
Upgrade
Fortinet FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
Fortinet FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
Fortinet FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.4.10 - Upgrade
Upgrade
Fortinet FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.4.8 - Upgrade
Upgrade
Fortinet FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
Fortinet FortiAnalyzerto a version that resolves this vulnerability.Fixed in 8.0.0 - Upgrade
Upgrade
Fortinet FortiAnalyzerto a version that resolves this vulnerability.Fixed in 6.4.16 - Upgrade
Upgrade
Fortinet FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
Fortinet FortiManagerto a version that resolves this vulnerability.Fixed in 7.4.7 - Upgrade
Upgrade
Fortinet FortiManagerto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
Fortinet FortiManagerto a version that resolves this vulnerability.Fixed in 8.0.0
Event History
Frequently Asked Questions
Which product versions are affected?
Affected FortiAnalyzer releases are 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, and all 7.2 versions. Affected FortiManager releases are 7.6.0 through 7.6.4, 7.4.0 through 7.4.6, and all 7.2 versions.
Does exploitation require an existing account or user interaction?
The vulnerability may be exploited by a low-privileged user through crafted requests. No user interaction is required, and the attack vector is network-based.
What could an attacker achieve if exploitation succeeds?
A successful attacker may execute arbitrary commands. The supplied severity vector indicates high potential impact to confidentiality, integrity, and availability.