CVE-2026-23706: SQL Injection
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.4.8 - Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.4.10 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 8.0.0 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 6.4.16 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.4.7 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 8.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a low-privileged account on an affected FortiAnalyzer, FortiAnalyzer Cloud, or FortiManager deployment. The attack can be performed over the network without user interaction.
Which deployments and releases are affected?
Affected releases include FortiAnalyzer 7.6.0–7.6.4, 7.4.0–7.4.7, and all 7.2 versions; FortiAnalyzer Cloud 7.6.2–7.6.4, 7.4.1–7.4.7, and 7.2.1–7.2.11; and FortiManager 7.6.0–7.6.4, 7.4.0–7.4.6, and all 7.2 versions.
What is the potential impact of successful exploitation?
A low-privileged user may execute arbitrary commands by sending crafted requests. The provided scoring indicates high confidentiality impact, with no stated integrity or availability impact.