CVE-2026-23707: SQL Injection
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4 may allow a low privileged user to execute arbitrary commands via crafted requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.4.8 - Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.4.10 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.4.8 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 8.0.0 - Upgrade
Upgrade
FortiManager Cloudto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.4.7 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 7.6.5 - Upgrade
Upgrade
FortiManagerto a version that resolves this vulnerability.Fixed in 8.0.0 - Upgrade
Upgrade
FortiAnalyzer Cloudto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
FortiAnalyzerto a version that resolves this vulnerability.Fixed in 6.4.16
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs a low-privileged authenticated account. The vulnerability does not require user interaction, and exploitation is performed through crafted requests.
Which deployments and releases are affected?
Affected products include FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud in the listed 7.6, 7.4, and 7.2 release ranges. FortiAnalyzer 7.2 and FortiManager 7.2 are affected in all versions.
What could a successful attacker do?
A low-privileged user may execute arbitrary commands by exploiting the SQL injection flaw. The published severity vector indicates high impacts to confidentiality, integrity, and availability.