FG-IR-26-239: Improper neutralization of argument delimiters in a command
Published Nov 10, 2026
·Updated
An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')[CWE-88] vulnerability in FortiManager,FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud may allow an authenticated privileged admin user to execute unauthorized code or commands.
Affected Software
16 affected componentsFixes available
Fortinet FortiAnalyzer=.
Fortinet FortiAnalyzer>=7.6.0<=7.6.7
Fortinet FortiAnalyzer>=7.4.0<=7.4.11
Fortinet FortiAnalyzer>=7.2.0<=7.2.12
Fortinet FortiAnalyzer Cloud=.
Fortinet FortiAnalyzer Cloud>=7.6.0<=7.6.7
Fortinet FortiAnalyzer Cloud>=7.4.1<=7.4.11
Fortinet FortiAnalyzer Cloud>=7.2.1<=7.2.12
Fortinet FortiManager=.
Fortinet FortiManager>=7.6.0<=7.6.7
Fortinet FortiManager>=7.4.0<=7.4.11
Fortinet FortiManager>=7.2.0<=7.2.12
Fortinet FortiManager Cloud=.
Fortinet FortiManager Cloud>=7.6.0<=7.6.7
Fortinet FortiManager Cloud>=7.4.1<=7.4.11
Fortinet FortiManager Cloud>=7.2.1<=7.2.12
Event History
Nov 10, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software