FortiAnalyzer CVE-2026-23706

Exploitation requires an authenticated low-privileged account on the target FortiAnalyzer (7.6.0-7.6.4, 7.4.0-7.4.7, 7.2 all versions), FortiAnalyzer Cloud (7.6.2-7.6.4, 7.4.1-7.4.7, 7.2.1-7.2.11), or FortiManager (7.6.0-7.6.4, 7.4.0-7.4.6, 7.2 all versions); per the CVSS vector (PR:L) valid low-privilege credentials or an existing user session are the key prerequisite. The attacker must be able to reach the management interface over the network to submit crafted requests, but no administrative rights, user interaction, or non-default configuration is indicated. The principal limiting factor is the authentication requirement, which confines exploitation to users who already have some access to the appliance.

This is a moderate-priority vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity flaw but one that requires an already-authenticated low-privileged account (PR:L), which materially limits the attacker population - this is a privilege-escalation/data-exposure issue for existing users, not an unauthenticated internet-facing RCE. The impact profile is unusual: it is scored confidentiality-only (C:H, I:N, A:N) even though the description says a low-privileged user 'may execute arbitrary commands,' so the Fortinet vector treats the practical outcome as unauthorized data access via SQL injection rather than integrity/availability loss - this apparent tension between the 'arbitrary commands' wording and C-only scoring should be verified with the vendor advisory. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; absent those signals the real-world urgency is driven mainly by the fact that FortiManager/FortiAnalyzer are high-value management platforms. Because no SSVC decision data, EPSS probability, or automatability signal was supplied, exploitation likelihood cannot be quantified and these data points are MISSING from the available intelligence.

An attacker who already holds a low-privileged account on a FortiAnalyzer, FortiAnalyzer Cloud, or FortiManager instance sends crafted requests containing malicious SQL payloads that are improperly neutralized, allowing them to read or manipulate backend database contents beyond their authorization level. Because the attack vector is network with low complexity and no user interaction, the requests can be issued directly against the management interface once a foothold account exists. No public exploit code was identified in the provided data.