FortiManager and FortiAnalyzer have authenticated OS command injection
Original title: Improper neutralization of special elements used in an os command
Fortinet scores FG-IR-26-224 at 7.2 and names cloud editions, but no versions or CVE.
Fortinet PSIRT revised FG-IR-26-224 on November 10, describing an OS command injection flaw (CWE-78) in FortiManager, FortiManager Cloud, FortiAnalyzer, and FortiAnalyzer Cloud. An authenticated administrator may execute unauthorized code or commands through specially crafted requests. The notice gives a CVSSv3 score of 7.2 and does not list versions, a fix, or a CVE.
Unconfirmed: The snippet does not state affected versions, a fix, a CVE, or exploitation.
- The advisory identifier is FG-IR-26-224.
- Both appliance and Cloud editions of both products are named.
- The flaw requires an authenticated administrator.
- No affected or fixed versions appear in the snippet.
Impact: authenticated administrator can run unauthorized code or commands
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiManager Cloud | — |
| Fortinet FortiAnalyzer | — |
| Fortinet FortiAnalyzer Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 2 An OS Command Injection vulnerability [CWE-78] in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.