FortiManager argument injection lets privileged admins run commands
Original title: Improper neutralization of argument delimiters in a command
The CWE-88 issue is scored 7.2 and also covers both Cloud products; exploitation is not stated.
Fortinet PSIRT reports a CWE-88 argument-injection flaw in FortiManager, FortiAnalyzer, FortiManager Cloud, and FortiAnalyzer Cloud. An authenticated privileged administrator may execute unauthorized code or commands. Advisory FG-IR-26-239 was revised on November 10, 2026. The snippet does not list versions or a patch.
Unconfirmed: Affected versions, fixes, and exploitation status are not stated.
- CVSSv3 score is 7.2.
- The attacker must already be a privileged admin.
- The weakness is classified as CWE-88.
- Four Fortinet management and analytics products are named.
Impact: privileged admin can run unauthorized code or commands
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiAnalyzer | — |
| Fortinet FortiManager Cloud | — |
| Fortinet FortiAnalyzer Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 2 An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')[CWE-88] vulnerability in FortiManager,FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud may allow an authenticated privileged admin user to execute unauthorized code or commands. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.