CyberCVE

CVE-2026-25689

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versions, FortiDeceptor 5.3 all versions, For

Severity
Medium 6
CVSS 3.1
Exploited
Not listed
EPSS
0.005
44.1th percentile
Discovered by
Vendor
Vendor advisory field
Published
Mar 10, 2026
Assigned by fortinet

Description

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versions, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all versions, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions may allow a privileged attacker with super-admin profile and CLI access to delete sensitive files via crafted HTTP requests.

Weakness: CWE-88

Affected products

Vendor Product Category Matched by
Fortinet FortiDeceptor Threat Detection & Sandbox cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiDeceptor

Credit

Internally discovered and reported by Adham El karn of Fortinet Product Security team.

Vendor remediation

Upgrade to FortiDeceptor version 6.2.1 or above Upgrade to FortiDeceptor version 6.1.0 or above

References

Something wrong here?