CVE-2025-46773
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
An SQL Injection vulnerability (CWE-89) in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, 7.4.1 through 7.4.7, and 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.
Risk Assessment
A low privileged user can execute arbitrary commands on the FortiAnalyzer system, potentially leading to privilege escalation and data breach.
Recommendation
Upgrade FortiAnalyzer and FortiAnalyzer Cloud to the latest version containing the fix provided by Fortinet.
Other vulnerabilities in FortiAnalyzer
See all- CVE-2026-84391Medium
A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow an attacker to cause denial of service. The attack vector is not specified.
- CVE-2025-61848High
An SQL injection vulnerability in Fortinet FortiAnalyzer, FortiManager and related products (listed versions) may allow a privileged authenticated attacker to execute unauthorized code or commands via JSON RPC API.
- CVE-2025-54973Medium
A race condition vulnerability in Fortinet FortiAnalyzer allows an attacker to bypass FortiCloud SSO authorization via crafted requests. Affects versions 7.0.0-7.0.13, 7.2.0-7.2.10, 7.4.0-7.4.6, 7.6.0-7.6.2.
Original NVD description (English source)
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS