CyberCVE

CVE-2026-23705

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through

Severity
Medium 6.5
CVSS 3.1
Remote, needs privileges or user interaction what this means
Exploited
Not listed
EPSS
0.003
22.1th percentile
Discovered by
Vendor
Vendor advisory acknowledgement
Published
Oct 13, 2026
Assigned by fortinet

Description

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.

Weakness: CWE-89

Affected products

Vendor Product Category Matched by
Fortinet FortiAnalyzer Check your version SIEM & Log Management cna-assigner
Fortinet FortiManager Check your version Network & Security Management cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiAnalyzer
  • Fortinet · FortiManager

Credit

Internally reported and discovered by Jaguar Perlas of Burnaby Infosec team and David Maciejack from Fortinet Product Security team.

Vendor remediation

Upgrade to FortiManager version 8.0.0 or above Upgrade to FortiManager version 7.6.5 or above Upgrade to FortiManager version 7.4.7 or above Upgrade to FortiManager Cloud version 7.6.5 or above Upgrade to FortiAnalyzer version 8.0.0 or above Upgrade to FortiAnalyzer version 7.6.5 or above Upgrade to FortiAnalyzer version 7.4.8 or above Upgrade to FortiAnalyzer version 7.4.10 or above Upgrade to upcoming FortiAnalyzer version 6.4.16 or above Upgrade to FortiAnalyzer Cloud version 7.6.5 or above Upgrade to FortiAnalyzer Cloud version 7.4.8 or above Upgrade to upcoming FortiAnalyzer Cloud version 7.2.13 or above

References

Something wrong here?