FG-IR-25-739: Multiple authenticated OS Command Injections via API
Published Dec 9, 2025
·Updated
An OS command injection vulnerabtility [CWE-78] in FortiExtender API may allow an authenticated attacker to execute unauthorized code or commands via a specific HTTP request.
Affected Software
4 affected componentsFixes available
Fortinet FortiExtender>=7.6.0<=7.6.3
Fortinet FortiExtender>=7.4.0<=7.4.7
Fortinet FortiExtender>=7.2
Fortinet FortiExtender>=7.0
Event History
Dec 9, 2025
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of FG-IR-25-739?
The severity of FG-IR-25-739 is critical due to the potential for unauthorized command execution.
2
How do I fix FG-IR-25-739?
To fix FG-IR-25-739, update FortiExtender to version 7.6.4 or 7.4.8 or later.
3
What versions of FortiExtender are affected by FG-IR-25-739?
Versions 7.6.0 to 7.6.3 and 7.4.0 to 7.4.7 of FortiExtender are affected by FG-IR-25-739.
4
Who can exploit FG-IR-25-739?
An authenticated attacker can exploit FG-IR-25-739 to execute unauthorized commands.
5
What is OS command injection in the context of FG-IR-25-739?
OS command injection in FG-IR-25-739 refers to the ability to execute arbitrary system commands through specially crafted HTTP requests.