FG-IR-26-249: Improper neutralization of special elements used in a template engine
Published Nov 10, 2026
·Updated
A Server-Side Template Injection vulnerability [CWE-1336] in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands via a specially crafted request.
Affected Software
4 affected componentsFixes available
Fortinet FortiAnalyzer=.
Fortinet FortiAnalyzer Cloud=.
Fortinet FortiManager=.
Fortinet FortiManager Cloud=.
Event History
Nov 10, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software