EUVD-2025-209453
GHSA-p356-3hpr-4rhh
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.8, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.0 through 7.4.8, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions may allow a privileged authenticated attacker to execute unauthorized code or commands via JSON RPC API
AnalysisAI
SQL injection in Fortinet FortiAnalyzer and FortiManager versions 7.0-7.6 allows privileged authenticated attackers to execute unauthorized code or commands via the JSON RPC API. This affects both on-premises and cloud variants across multiple major version branches (7.0, 7.2, 7.4, 7.6). The vulnerability requires high-privilege authentication (CVSS PR:H) but is remotely exploitable with low attack complexity. No public exploit identified at time of analysis, though the network attack vector and code execution capability make this a priority for organizations running affected Fortinet management infrastructure.
Technical ContextAI
This vulnerability stems from CWE-89 (Improper Neutralization of Special Elements in SQL Command) in the JSON RPC API interface of FortiAnalyzer and FortiManager products. These are Fortinet's centralized logging/analytics and device management platforms respectively, used to administer enterprise Fortinet security infrastructure. The flaw allows SQL injection through crafted API requests, bypassing input validation controls. Affected products include FortiAnalyzer (CPE: cpe:2.3:a:fortinet:fortianalyzer), FortiManager (CPE: cpe:2.3:a:fortinet:fortimanager), and their cloud-hosted variants across four major version families. The JSON RPC API is a remote management interface typically exposed to administrative networks, making proper authentication enforcement critical. SQL injection in management platforms is particularly severe as these systems often have elevated database privileges and access to sensitive configuration data across managed devices.
RemediationAI
Apply vendor-released patches according to Fortinet advisory FG-IR-26-111. Based on affected version data, organizations should upgrade to versions beyond 7.6.4 for 7.6 branch deployments, beyond 7.4.8 for 7.4 branch, and migrate away from unsupported 7.2 and 7.0 branches entirely. Consult the official Fortinet FortiGuard advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-111 for exact patched versions and upgrade paths specific to each product variant. As interim mitigations until patching, restrict JSON RPC API access to trusted administrative networks only using firewall rules, implement strict monitoring of API access logs for suspicious SQL patterns, enforce multi-factor authentication for all privileged accounts with API access, and apply principle of least privilege to limit high-privilege account distribution. Review administrative account activity logs for signs of unauthorized API usage during the vulnerability window.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
Unauthenticated OS command injection in Fortinet FortiSandbox (on-premise, Cloud, and PaaS variants) allows remote attac
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today