FortiManager and FortiAnalyzer API format-string flaw scores CVSS 7.2
Original title: Improper neutralization of special elements used in a template engine in fortisoc
An authenticated attacker can run unauthorized commands through a crafted HTTP request to the named cloud and on-prem APIs.
Fortinet PSIRT FG-IR-26-220 describes a use of an externally controlled format string (CWE-134) in the FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud API. The vendor rates it CVSSv3 7.2. An authenticated attacker may execute unauthorized commands with a specially crafted HTTP request. The notice was revised on November 10, 2026.
Unconfirmed: Affected and fixed versions and exploitation status are not in the snippet; the title also names FortiSOC and a template engine, which the body does not.
- CWE-134 format-string issue, CVSSv3 score 7.2.
- Products named: FortiManager, FortiAnalyzer and both Cloud APIs.
- Revised on November 10, 2026; advisory id FG-IR-26-220.
- The feed title mentions a template engine in FortiSOC, which the body does not.
Impact: authenticated attacker can execute unauthorized commands
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiAnalyzer | — |
| Fortinet FortiManager Cloud | — |
| Fortinet FortiAnalyzer Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 2 A Use of Externally-Controlled Format String [CWE-134] in FortiManager, FortiAnalyzer, FortiManager Cloud and FortiAnalyzer Cloud API may allow an authenticated attacker to execute unauthorized commands via specially crafted HTTP request Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.