6.5
Medium
CVE-2026-23707 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]…
Description
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4 may allow a low privileged user to execute arbitrary commands via crafted requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiManager Cloud 7.6 | 7.6.2 → 7.6.4 | No fix stated |
| FortiAnalyzer Cloud 7.6 | 7.6.2 → 7.6.4 | No fix stated |
| FortiManager 7.6 | 7.6.0 → 7.6.4 | No fix stated |
| FortiAnalyzer 7.6 | 7.6.0 → 7.6.4 | No fix stated |
References
- fortiguard.fortinet.com fortiguard.fortinet.com
Timeline
- Published
- Last modified
Other CVEs of FortiManager Cloud
The 17 CVEs of FortiManager Cloud →
CVE-2026-106171
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet…
5.3
Medium
CVE-2026-22575
An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through…
4.7
Medium
CVE-2026-70468
A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager…
7.3
High
CVE-2025-68649
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet…
5.4
Medium