CVE-2026-23706
MediumCVSS 6.5Summary
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer and FortiManager (including Cloud versions) may allow a low privileged user to execute arbitrary commands via crafted requests.
Risk Assessment
A low privileged user can execute arbitrary commands, potentially leading to privilege escalation and system compromise. Multiple FortiAnalyzer and FortiManager versions are affected.
Recommendation
Update FortiAnalyzer and FortiManager to versions containing the fix. Restrict access to management interfaces to trusted networks.
Other vulnerabilities in FortiAnalyzer/FortiManager
See all- CVE-2024-45331High
A privilege escalation vulnerability in Fortinet FortiAnalyzer and FortiManager allows an attacker to escalate privileges via specific shell commands. The flaw is due to incorrect privilege assignment in multiple versions of these products.
- CVE-2024-35276Medium
A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer and FortiManager allows a remote attacker to execute unauthorized code or commands via specially crafted packets. The issue affects multiple versions of these products, including cloud variants.
Original NVD description (English source)
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS