FortiAnalyzer EUVD-2025-211084

Exploitation requires the attacker to already possess a valid low-privileged user account on the FortiAnalyzer or FortiAnalyzer Cloud management interface (PR:L), and network reachability to that interface. Affected deployments are FortiAnalyzer 7.6.0-7.6.4, 7.4.0-7.4.7, and all 7.2 versions, and FortiAnalyzer Cloud 7.6.2-7.6.4, 7.4.1-7.4.7, and 7.2.1-7.2.11. The primary limiting factor is the authentication requirement: unauthenticated external attackers cannot directly exploit this, so realistic risk is confined to insider accounts, compromised low-tier credentials, or exploitation chained after an initial foothold. No special non-default feature or configuration mode is named in the description as a prerequisite.

This is a credible, elevated-priority issue but not a top-of-queue emergency based on available signals. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity attack that requires only low-level authentication (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with SQL injection escalating to arbitrary command execution. However, several real-risk-tempering factors exist: there is no EPSS score provided, no CISA KEV listing, and no public exploit code identified at time of analysis, so there is no evidence of active exploitation or widespread weaponization. The PR:L requirement means an attacker must already hold a valid low-privileged account on the FortiAnalyzer management plane, which meaningfully narrows the realistic attacker set to insiders, credential-compromise scenarios, or chained post-authentication access. No EPSS, KEV, POC, or SSVC data was supplied, so exploitation likelihood cannot be quantitatively corroborated - the assessment rests solely on the vendor-issued CVSS vector and description. The CVSS vector and the description are mutually consistent (both imply authenticated remote access), so there is no vector/description conflict to flag.

An attacker holding a low-privileged FortiAnalyzer or FortiAnalyzer Cloud account sends a crafted request containing malicious SQL special elements to a vulnerable endpoint, which is improperly neutralized and allows the attacker to execute arbitrary commands on the appliance. Because the management interface is network-accessible and the attack complexity is low, a single compromised or rogue low-tier account could lead to full control of the log-management platform. No public exploit code has been identified at time of analysis.