FG-IR-26-219: JSON Injection in JRPC API
Published Nov 10, 2026
·Updated
An Improper Encoding or Escaping of Output vulnerability [CWE-116] in FortiSASE-Sovereign, FortiAnalyzer, FortiManager, FortiAnalyzer Cloud, FortiManager Cloud and FortiAnalyzer Big-Data GUI may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request
Affected Software
13 affected componentsFixes available
Fortinet FortiAnalyzer>=8.0.0<=8.0.2
Fortinet FortiAnalyzer>=7.6.0<=7.6.7
Fortinet FortiAnalyzer Cloud>=8.0.1<=8.0.2
Fortinet FortiAnalyzer Cloud>=7.6.0<=7.6.7
Fortinet FortiAnalyzer-BigData>=7.6.0<=7.6.2
Fortinet FortiManager>=8.0.0<=8.0.2
Fortinet FortiManager>=7.6.0<=7.6.7
Fortinet FortiManager Cloud>=8.0.1<=8.0.2
Fortinet FortiManager Cloud>=7.6.0<=7.6.7
Fortinet FortiSASE-Sovereign>=26.2
Fortinet FortiSASE-Sovereign>=25.4
Fortinet FortiSASE-Sovereign>=25.3
Fortinet FortiSASE-Sovereign>=25
Event History
Nov 10, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software