FortiManager and FortiAnalyzer SQL injection scores CVSS 7.1
Original title: Improper neutralization of special elements used in an SQL command
An authenticated attacker can run unauthorized SQL commands through specially crafted requests.
Fortinet PSIRT discloses an SQL injection flaw in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud. The issue, CVSSv3 7.1 and tracked as FG-IR-26-233, may let an authenticated attacker execute unauthorized SQL commands via specially crafted requests. It was revised on November 10, 2026. The snippet does not list versions, a fix, a CVE id or exploitation.
Unconfirmed: The snippet does not state versions, remediation, a CVE id or known exploitation.
- CVSSv3 score is 7.1; the weakness is CWE-89.
- Access required is an authenticated attacker.
- Cloud editions of both products are listed as affected.
- The advisory was revised on November 10, 2026.
Impact: Authenticated execution of unauthorized SQL commands
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiManager Cloud | — |
| Fortinet FortiAnalyzer | — |
| Fortinet FortiAnalyzer Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 1 An SQL Injection vulnerability [CWE-89] in FortiManager, FortiManager Cloud, FortiAnalyzer, FortiAnalyzer Cloud may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.