FG-IR-26-178: Multiple Arbitrary File Read/Write via SQL Injection
Published Oct 13, 2026
·Updated
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests.
Affected Software
10 affected componentsFixes available
Fortinet FortiAnalyzer>=7.6.0<=7.6.4
Fortinet FortiAnalyzer>=7.4.0<=7.4.7
Fortinet FortiAnalyzer>=7.2
Fortinet FortiAnalyzer Cloud>=7.6.2<=7.6.4
Fortinet FortiAnalyzer Cloud>=7.4.1<=7.4.7
Fortinet FortiAnalyzer Cloud>=7.2.1<=7.2.11
Fortinet FortiManager>=7.6.0<=7.6.4
Fortinet FortiManager>=7.4.0<=7.4.6
Fortinet FortiManager>=7.2
Fortinet FortiManager Cloud>=7.6.2<=7.6.4
Event History
Oct 13, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software