SQL injection in FortiAnalyzer and FortiManager allows authenticated code execution
Original title: Improper neutralization of special elements used in an SQL command
The CVSS 8.8 flaw also covers both Cloud products and is triggered by crafted JSON-RPC requests.
Fortinet PSIRT describes an SQL injection flaw in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud. An authenticated attacker may execute unauthorized code or commands through crafted JSON-RPC requests. The notice was revised on November 10. The snippet gives no affected versions, fix, CVE or exploitation status.
Unconfirmed: Affected versions, a fix, a CVE and exploitation status are not stated.
- CVSS v3 score is 8.8.
- Fortinet classifies the issue as CWE-89.
- The advisory was revised on November 10.
- Attackers must already be authenticated.
Impact: Authenticated code or command execution
| Product | Affected |
|---|---|
| Fortinet FortiAnalyzer | — |
| Fortinet FortiAnalyzer Cloud | — |
| Fortinet FortiManager | — |
| Fortinet FortiManager Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 8. 8 An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow an authenticated attacker to execute unauthorized code or commands via crafted JSON-RPC requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.