CyberCVE

CVE-2026-25690

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.

Severity
Medium 4
CVSS 3.1
Exploited
Not listed
EPSS
0.002
15.5th percentile
Discovered by
Vendor
Vendor advisory field
Published
May 12, 2026
Assigned by fortinet

Description

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.0 through 5.2.1, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests.

Weakness: CWE-88

Affected products

Vendor Product Category Matched by
Fortinet FortiDeceptor Threat Detection & Sandbox cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiDeceptor

Credit

Internally discovered and reported by Adham El karn of Fortinet Product Security team.

Vendor remediation

Upgrade to upcoming FortiDeceptor version 6.3.0 or above Upgrade to FortiDeceptor version 6.1.0 or above

References

Something wrong here?