collectoragent SQL injection allows authenticated command execution
Original title: Improper neutralization of special elements used in an SQL command in collectoragent
Fortinet scores the collectoragent flaw CVSS 8.3 and says it is reachable through HTTP requests.
Fortinet PSIRT reports an SQL injection vulnerability in collectoragent. An authenticated attacker may execute unauthorized code or commands via HTTP requests. The notice, revised on November 10, gives a CVSS v3 score of 8.3 but no product versions, fix, CVE or exploitation status.
Unconfirmed: The broader product name, versions, fix, CVE and exploitation status are not stated.
- CVSS v3 score is 8.3.
- Exploitation requires an authenticated attacker.
- The vector described is HTTP requests.
- The advisory was revised on November 10.
Impact: Authenticated code or command execution
| Product | Affected |
|---|---|
| Fortinet collectoragent | — |
- Vendors
- Fortinet
- Products
- collectoragent
From the original article
CVSSv3 Score: 8. 3 An improper neutralization of special elements used in an sql command ('sql injection')[CWE-89] vulnerability may allow an authenticated attacker to execute unauthorized code or commands via http requests Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.