Multiple Arbitrary File Read/Write via SQL Injection
Fortinet says SQL injection in FortiAnalyzer and FortiManager lets low-privileged users run arbitrary commands.
Fortinet PSIRT advisory FG-IR-26-178 describes an SQL injection (CWE-89) in FortiAnalyzer, FortiManager, and their cloud editions. A low-privileged user can execute arbitrary commands through crafted requests. Fortinet rates the issue CVSS 7.9. The advisory was revised on 2026-10-13 and does not report in-the-wild exploitation or a CVE identifier.
- CVSS 7.9 SQL injection (CWE-89) in FortiAnalyzer and FortiManager
- Low-privileged users can run arbitrary commands via crafted requests
- On-premises and cloud FortiAnalyzer and FortiManager are affected
- Advisory FG-IR-26-178 cites no CVE or observed exploitation
CVSSv3 Score: 7.9 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests. Revised on 2026-10-13 00:00:00
This source does not provide full text. Read it at fortiguard.fortinet.com.