CyberCVE

CVE-2025-61848

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.

Severity
Medium 6.5
CVSS 3.1
Exploited
Not listed
EPSS
0.005
42.6th percentile
Discovered by
Vendor
Vendor advisory field
Published
Apr 14, 2026
Assigned by fortinet

Description

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.3, FortiAnalyzer-BigData 7.6.0 through 7.6.1, FortiAnalyzer-BigData 7.4.0 through 7.4.5, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.2 through 7.6.4 may allow a privileged authenticated attacker to execute unauthorized code or commands via JSON RPC API

Weakness: CWE-89

Affected products

Vendor Product Category Matched by
Fortinet FortiAnalyzer SIEM & Log Management cna-assigner
Fortinet FortiManager Network & Security Management cna-assigner
Vendor-reported products (5)
  • Fortinet · FortiManager
  • Fortinet · FortiAnalyzer
  • Fortinet · FortiAnalyzer-BigData
  • Fortinet · FortiManager Cloud
  • Fortinet · FortiAnalyzer Cloud

Credit

Internally discovered and reported by David Maciejak of Fortinet Product Security team.

Vendor remediation

Upgrade to FortiManager version 8.0.0 or above Upgrade to FortiManager version 7.6.5 or above Upgrade to FortiManager version 7.4.9 or above Upgrade to FortiAnalyzer version 7.6.5 or above Upgrade to FortiAnalyzer version 7.4.9 or above Upgrade to FortiManager Cloud version 7.6.5 or above Upgrade to FortiAnalyzer Cloud version 7.6.4 or above

References

Something wrong here?