Most severe vulnerabilities for "fortinet fortianalyzer cloud" 7.4.0

Fortinet FortiAnalyzerFormat string vulnerability in fazsvcd

Risk 66

Severity

7.2

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

A use of externally-controlled format string vulnerability [CWE-134] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud fazsvcd daemon may allow a remote privileged attacker with admin profile to execute arbitrary code or commands via specially crafted requests.

1 / 2

Source: FortiGuard

Remedy

Upgrade to FortiAnalyzer Cloud version 7.6.5 or above Upgrade to FortiAnalyzer Cloud version 7.4.8 or above Upgrade to FortiAnalyzer version 7.6.5 or above Upgrade to FortiAnalyzer version 7.4.8 or above Upgrade to FortiManager Cloud version 7.6.5 or above Upgrade to FortiManager Cloud version 7.4.8 or above Upgrade to FortiManager version 7.6.5 or above Upgrade to FortiManager version 7.4.8 or above

First published (updated )

CVE-2025-68648

Fortinet FortiAnalyzerSQL Injection via JSON RPC API

Risk 66

Severity

7.2

SQL Injection

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

An improper neutralization of special elements used in an SQL command ('SQL injection') [CWE-89] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests.

1 / 2

Source: FortiGuard

First published (updated )

CVE-2025-61848

Fortinet FortiAnalyzerSQL Injection via JSON RPC API

Risk 65

Severity

6.8

SQL Injection

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

An improper neutralization of special elements used in an SQL command ('SQL injection') [CWE-89] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests.

First published (updated )

Advisory

FG-IR-26-111

Fortinet FortiAnalyzerFormat string vulnerability in fazsvcd

Risk 64

Severity

6.5

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

A use of externally-controlled format string vulnerability [CWE-134] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud fazsvcd daemon may allow a remote privileged attacker with admin profile to execute arbitrary code or commands via specially crafted requests.

First published (updated )

Advisory

FG-IR-26-092

Fortinet FortiAnalyzerPath Traversal in CLI

Risk 49

Severity

6.5

Path Traversal

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow a privileged attacker to delete files from the underlying filesystem via crafted CLI requests.

1 / 2

Source: FortiGuard

Remedy

Upgrade to FortiManager Cloud version 7.6.5 or above Upgrade to FortiManager Cloud version 7.4.8 or above Upgrade to FortiManager version 7.6.5 or above Upgrade to FortiManager version 7.4.8 or above Upgrade to FortiAnalyzer version 7.6.5 or above Upgrade to FortiAnalyzer version 7.4.8 or above Upgrade to FortiAnalyzer Cloud version 7.6.5 or above Upgrade to FortiAnalyzer Cloud version 7.4.8 or above

First published (updated )

CVE-2025-68649

Fortinet FortiAnalyzerPath Traversal in CLI

Risk 43

Severity

5.4

Path Traversal

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow a privileged attacker to delete files from the underlying filesystem via crafted CLI requests.

First published (updated )

Advisory

FG-IR-26-120

Trending

Fortinet FortiAnalyzerFormat string vulnerability in fazsvcd

Remedy

Fortinet FortiAnalyzerSQL Injection via JSON RPC API

Fortinet FortiAnalyzerSQL Injection via JSON RPC API

Fortinet FortiAnalyzerFormat string vulnerability in fazsvcd

Fortinet FortiAnalyzerPath Traversal in CLI

Remedy

Fortinet FortiAnalyzerPath Traversal in CLI

Company

Resources

Contact