Restricted FortiManager users can run commands via template injection
Original title: Improper neutralization of special elements used in a template engine
Scored CVSS 7.2, it also hits FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud, with no exploitation stated.
Fortinet discloses a server-side template injection flaw in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud. An authenticated attacker who already has restricted privileges may execute unauthorized code or commands through a specially crafted request. Advisory FG-IR-26-249 was revised on November 10. The snippet does not name builds or a fix.
Unconfirmed: Affected versions, fixes, CVE identifiers and exploitation status are not stated.
- The weakness type is CWE-1336 server-side template injection.
- Fortinet tracks the advisory as FG-IR-26-249.
- The attacker must already have restricted authenticated access.
- No fixed build is named in the notice.
Impact: restricted authenticated user can run unauthorized code
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiManager Cloud | — |
| Fortinet FortiAnalyzer | — |
| Fortinet FortiAnalyzer Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 2 A Server-Side Template Injection vulnerability [CWE-1336] in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands via a specially crafted request. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.