FortiAnalyzer and FortiManager HA plugin command injection scores 7.2
Original title: Improper neutralization of special elements used in an OS command
An authenticated attacker can run unauthorized commands by sending a crafted HTTP request to the system-ha plugin.
Fortinet PSIRT FG-IR-26-246 describes an OS command injection (CWE-78) in the system-ha plugin of FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud. CVSSv3 is 7.2. An authenticated attacker may execute unauthorized commands via a crafted HTTP request. The notice was revised on November 10, 2026.
Unconfirmed: Affected versions, fixes and exploitation status are not stated in the snippet.
- Flaw is in the system-ha plugin, CWE-78, CVSSv3 7.2.
- Covers on-prem and Cloud FortiAnalyzer and FortiManager.
- Access required is an authenticated attacker, not an anonymous one.
- Revised on November 10, 2026; id FG-IR-26-246.
Impact: authenticated attacker can execute unauthorized commands
| Product | Affected |
|---|---|
| Fortinet FortiAnalyzer | — |
| Fortinet FortiAnalyzer Cloud | — |
| Fortinet FortiManager | — |
| Fortinet FortiManager Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 2 An improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability (CWE-78) in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud system-ha plugin may allow an authenticated attacker to execute unauthorized commands via a crafted HTTP request. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.