Skip to content
fr Sign in
5.9 Medium

CVE-2026-23706 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]…

Description

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.2.1 through 7.2.9, FortiManager 7.6.0 through 7.6.2, FortiManager 7.4.0 through 7.4.6 may allow a low privileged user to execute arbitrary commands via crafted requests.

Affected products and versions

Product Affected versions Fixed in
FortiAnalyzer Cloud 7.6.2 No fix stated
FortiAnalyzer Cloud 7.4 7.4.1 → 7.4.6 No fix stated
FortiAnalyzer Cloud 7.2 7.2.1 → 7.2.9 No fix stated
FortiManager 7.6 7.6.0 → 7.6.2 No fix stated
FortiManager 7.4 7.4.0 → 7.4.6 No fix stated
FortiAnalyzer 7.6 7.6.0 → 7.6.2 No fix stated
FortiAnalyzer 7.4 7.4.1 → 7.4.6 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of FortiAnalyzer Cloud

The 14 CVEs of FortiAnalyzer Cloud →
CVE-2025-46773 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]… 7.9 High CVE-2026-23707 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]… 6.5 Medium CVE-2025-68649 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet… 5.4 Medium CVE-2025-61848 An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet… 6.5 Medium
Track this CVE