FortiAnalyzer and FortiManager OS command injection scores CVSS 7.2
Original title: Improper neutralization of special elements used in an OS command
An authenticated privileged attacker can run unauthorized code via a crafted report schedule name.
Fortinet PSIRT describes an OS command injection flaw in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud. The issue, scored CVSSv3 7.2 and tracked as FG-IR-26-241, may let an authenticated privileged attacker execute unauthorized code or commands through a crafted report schedule name. The advisory was revised on November 10, 2026. The snippet gives no affected versions, fix, CVE id or exploitation status.
Unconfirmed: The snippet does not state affected versions, a fix, a CVE id or whether the flaw is exploited.
- CVSSv3 score is 7.2; the weakness is CWE-78.
- Trigger is a crafted report schedule name.
- Products include FortiAnalyzer Cloud and FortiManager Cloud.
- The advisory was revised on November 10, 2026.
Impact: Authenticated privileged unauthorized code or command execution
| Product | Affected |
|---|---|
| Fortinet FortiAnalyzer | — |
| Fortinet FortiAnalyzer Cloud | — |
| Fortinet FortiManager | — |
| Fortinet FortiManager Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 2 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted report schedule name. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.