EUVD-2026-29548
GHSA-p3gf-69rv-54rw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through 7.4.9, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
AnalysisAI
SQL injection in Fortinet FortiNDR 7.0 through 7.6.2 allows authenticated attackers to execute unauthorized code or commands via crafted HTTP requests. The vulnerability affects multiple versions across the 7.x branch and has an EPSS exploitation probability indicator (E:P in CVSS), suggesting feasible attack conditions despite moderate CVSS score (5.1). Patch availability and active exploitation status require confirmation from vendor advisory.
Technical ContextAI
The vulnerability is rooted in improper neutralization of special SQL metacharacters (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) in the FortiNDR application's HTTP request handling. FortiNDR is Fortinet's Network Detection and Response platform, used for threat detection and investigation across enterprise networks. The flaw exists in how the application constructs SQL queries from user-supplied input in HTTP requests without sufficient parameterization or sanitization. An authenticated user can inject SQL commands that alter query logic, potentially accessing or modifying unauthorized data or executing code at the database privilege level. The wide version range (7.0-7.6.2) indicates a long-standing issue likely introduced in FortiNDR 7.0 and persisting through multiple minor releases.
RemediationAI
Obtain and apply the vendor-released patch from Fortinet immediately; specific fixed version numbers must be confirmed at https://fortiguard.fortinet.com/psirt/FG-IR-26-134. If patches are unavailable or deployment delays are unavoidable, implement compensating controls: (1) restrict FortiNDR web interface access to trusted internal networks or VPN connections only (eliminates network-based attack vector for non-privileged users), (2) enforce strong authentication and multi-factor authentication (MFA) for all FortiNDR user accounts to reduce likelihood of attacker obtaining valid credentials, (3) audit and revoke unnecessary user accounts and API tokens (reduces authenticated attack surface), (4) monitor SQL query logs and application logs for suspicious patterns such as SQL metacharacters (semicolons, quotes, boolean operators) in HTTP parameters, and (5) implement Web Application Firewall (WAF) rules to block requests containing common SQL injection payloads. Trade-off: restricting network access may impact remote analyst access; MFA adds friction to user experience but is essential for this attack vector. WAF rules may generate false positives if legitimate use cases require special characters. Prioritize patching over compensating controls due to the simplicity of SQL injection exploitation.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today