Fortinet GUI OS command injection hits FortiManager and FortiAnalyzer
Original title: Improper neutralization of special elements used in an os command in GUI
FG-IR-26-251 also names FortiSASE-Sovereign and is scored 7.2 for authenticated HTTP requests.
Fortinet PSIRT revised FG-IR-26-251 on November 10, an OS command injection flaw (CWE-78) in the GUI of FortiManager, FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud, and FortiSASE-Sovereign. An authenticated attacker may execute unauthorized code or commands through specially crafted HTTP requests. The CVSSv3 score is 7.2. The snippet gives no versions, fix, or CVE.
Unconfirmed: Affected versions, a fixed release, a CVE, and exploitation are not stated.
- FortiSASE-Sovereign is included alongside the manager and analyzer products.
- The issue is in the GUI and uses crafted HTTP requests.
- Authentication is required.
- The advisory was revised on November 10, 2026.
Impact: authenticated attacker can run unauthorized code or commands
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiAnalyzer | — |
| Fortinet FortiManager Cloud | — |
| Fortinet FortiAnalyzer Cloud | — |
| Fortinet FortiSASE-Sovereign | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 2 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [cwe-78] in FortiManager, FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud, FortiSASE-Sovereign GUI may allow an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.