CyberCVE

CVE-2026-25689

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versions, FortiDeceptor 5.3 all versions, For

Severity
Medium 6
CVSS 3.1
Exploited
Not listed
EPSS
0.005
42.1th percentile
Discovered by
Not disclosed
Published
Mar 10, 2026
Assigned by fortinet

Description

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versions, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all versions, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions may allow a privileged attacker with super-admin profile and CLI access to delete sensitive files via crafted HTTP requests.

Weakness: CWE-88

Affected products

Vendor Product Category Matched by
Fortinet FortiDeceptor Threat Detection & Sandbox cna-assigner
Vendor-reported affected versions (1)
  • Fortinet · FortiDeceptor

Vendor remediation

Upgrade to FortiDeceptor version 6.2.1 or above Upgrade to FortiDeceptor version 6.1.0 or above

References