FortiManager and FortiAnalyzer code injection lets admins run commands
Original title: Improper control of generation of code
FG-IR-26-230 scores CVSS 7.2 and also covers both products’ cloud editions; no fix is stated.
Fortinet PSIRT revised FG-IR-26-230 on November 10. A CWE-94 code-injection flaw in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may let an authenticated administrator run unauthorized code or commands through specially crafted requests. The CVSSv3 score is 7.2. The snippet gives no versions, patch or exploitation status.
Unconfirmed: The snippet does not state affected versions, a fix, or whether the flaw is exploited.
- The advisory identifier is FG-IR-26-230.
- The listed weakness is CWE-94 code injection.
- Access requires an authenticated administrator.
- FortiManager Cloud and FortiAnalyzer Cloud are included.
Impact: authenticated administrator code or command execution
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiManager Cloud | — |
| Fortinet FortiAnalyzer | — |
| Fortinet FortiAnalyzer Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 2 A Code Injection vulnerability [CWE-94] in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.