Fortinet details three injection flaws in manager and mail products

Fortinet revised three 13 October 2026 injection advisories, with CVSS 7.9, 7.7 and 5.3, and no CVEs or known exploitation.

Fortinet PSIRT revised three separate advisories on 13 October 2026 and did not report in-the-wild exploitation. FG-IR-26-178 describes CWE-89 SQL injection in on-premises and cloud FortiAnalyzer and FortiManager, scored CVSS 7.9, letting a low-privileged user execute arbitrary commands through crafted requests; its title instead refers to arbitrary file read/write. FG-IR-26-184 describes CWE-89 SQL command injection in FortiMail webmail, scored CVSS 7.7, through which an authenticated attacker may run unauthorized code or commands with crafted HTTP requests. FG-IR-26-177 describes CWE-78 OS command injection in the FortiManager fgfmd daemon, scored CVSS 5.3, but only after the attacker possesses a cluster node's certificate and private key and impersonates that node with crafted packets. Reports 1 and 3 explicitly state that no CVE was assigned; report 2 likewise gives none. The write-ups do not conflict on scores, products, or exploitation status, and none give versions or mitigations.

• FG-IR-26-178 (revised 2026-10-13): CWE-89 SQL injection in on-premises and cloud FortiAnalyzer and FortiManager, CVSS 7.9; a low-privileged user can run arbitrary commands via crafted requests. The advisory title instead says arbitrary…
• FG-IR-26-184 (revised 2026-10-13): CWE-89 SQL command injection in FortiMail webmail, CVSS 7.7; an authenticated attacker may execute unauthorized code or commands via crafted HTTP requests. In-the-wild exploitation is not mentioned, and…
• FG-IR-26-177: CWE-78 OS command injection in the FortiManager fgfmd daemon, CVSS 5.3. A remote attacker who already holds a cluster node's certificate and private key can impersonate that node and use crafted packets to run unauthorized…
• The three advisories are separate PSIRT items and do not state affected versions, impact counts, or mitigations.