CVE-2026-23706
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through
Description
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.
Weakness: CWE-89
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiAnalyzer Check your version | SIEM & Log Management | cna-assigner |
| Fortinet | FortiManager Check your version | Network & Security Management | cna-assigner |
Vendor-reported products (3)
- Fortinet · FortiAnalyzer Cloud
- Fortinet · FortiManager
- Fortinet · FortiAnalyzer
Credit
Internally reported and discovered by Jaguar Perlas of Burnaby Infosec team and David Maciejack from Fortinet Product Security team.
Vendor remediation
Upgrade to FortiManager version 8.0.0 or above Upgrade to FortiManager version 7.6.5 or above Upgrade to FortiManager version 7.4.7 or above Upgrade to FortiManager Cloud version 7.6.5 or above Upgrade to FortiAnalyzer version 8.0.0 or above Upgrade to FortiAnalyzer version 7.6.5 or above Upgrade to FortiAnalyzer version 7.4.8 or above Upgrade to FortiAnalyzer version 7.4.10 or above Upgrade to upcoming FortiAnalyzer version 6.4.16 or above Upgrade to FortiAnalyzer Cloud version 7.6.5 or above Upgrade to FortiAnalyzer Cloud version 7.4.8 or above Upgrade to upcoming FortiAnalyzer Cloud version 7.2.13 or above