Fortinet FortiNDR CVE-2026-25088

The specific exploitation condition is that the attacker must be an authenticated user with a valid FortiNDR account (PR:L in CVSS vector). No special configuration or non-default settings are explicitly mentioned in the CVE description. The vulnerability affects standard FortiNDR installations across the stated version range without requiring any optional features or unusual deployment modes. HTTP request crafting capability and knowledge of FortiNDR's HTTP API or web interface parameter names is necessary. The lack of UI requirement (UI:N) indicates automated or programmatic exploitation is feasible once attack parameters are known. Exploitation is limited to authenticated users; unauthenticated remote attackers cannot trigger this vulnerability without first obtaining valid credentials.

This vulnerability presents MODERATE real-world risk with conflicting signals. CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network-accessible exploitation requiring low complexity and low-level authentication (PR:L), with limited impact (confidentiality and integrity degradation, no availability loss). However, CVSS score of 5.1 (Medium) understates risk due to the E:P (Proof of Concept Exists) environmental metric, which elevates exploitation likelihood. The presence of an authenticated attacker requirement (PR:L) significantly reduces attack surface compared to unauthenticated vectors-exploitation requires a valid FortiNDR user account. SSVC framework analysis: exploitation status is feasible (E:P suggests POC availability); technical impact is limited (no system availability impact, only confidentiality and integrity of accessed data); automatable exploitation is likely given SQL injection's well-understood techniques. Real-world risk depends critically on: (1) whether FortiNDR is internet-facing or restricted to internal networks, (2) whether user account compromise is a realistic threat vector in the defender's environment, and (3) whether the affected versions remain in production. Organizations with strict internal-only FortiNDR deployments and strong authentication controls face lower risk than those with internet exposure or weak account management. The lack of availability impact (A:N) limits this to data exfiltration or manipulation rather than service disruption.

An authenticated FortiNDR analyst with legitimate credentials receives a phishing email or social engineering prompt directing them to click a link that initiates a malicious HTTP request to the FortiNDR web interface. Alternatively, an insider with a valid FortiNDR account crafts an HTTP request with SQL injection payload in a query parameter (e.g., a search filter or report generation field). The injected SQL command is executed in the context of the FortiNDR database, allowing the attacker to extract sensitive network detection data, modify alert configurations, or exfiltrate logs. Because PR:L authentication is required, the attacker must either compromise a legitimate user account or be an insider.