Fortinet FortiAnalyzer and FortiManager Vulnerable to Command Execution via SQL Injection
Fortinet has released security advisory FG-IR-26-178 detailing a critical SQL injection vulnerability affecting FortiAnalyzer and FortiManager products, allowing low-privileged users to execute arbitrary commands.
Fortinet has issued a critical security advisory, FG-IR-26-178, detailing a severe SQL injection vulnerability (CWE-89) that impacts multiple versions of its FortiAnalyzer and FortiManager products, including their cloud-hosted variants. This flaw, with a CVSSv3 score of 7.9, grants a high level of severity and poses a significant risk to organizations relying on these network security management solutions.
The vulnerability stems from an improper neutralization of special elements used in SQL commands. Attackers can exploit this by sending specially crafted requests to the affected devices. Successful exploitation allows a low-privileged user, who would normally have limited access, to execute arbitrary commands on the underlying system. This capability can lead to a complete compromise of the affected appliance, enabling attackers to gain unauthorized access, exfiltrate sensitive data, or further pivot into the network.
Multiple versions of FortiAnalyzer and FortiManager are affected, including FortiAnalyzer versions 8.0, 7.6, 7.4, and 7.2, as well as their corresponding cloud offerings. Similarly, FortiManager versions 8.0, 7.6, 7.4, and 7.2, along with their cloud counterparts, are also vulnerable. The advisory lists specific product names and versions, emphasizing the broad scope of potential impact across different deployment scenarios.
Fortinet has assigned multiple CVE identifiers to this vulnerability, including CVE-2025-46773, CVE-2026-23705, CVE-2026-23706, and CVE-2026-23707. These identifiers will help security teams track and manage the remediation efforts across their environments. The advisory also notes that the vulnerability was internally reported and discovered by security researchers from Burnaby Infosec team and Fortinet's Product Security team.
While the advisory does not explicitly state whether this vulnerability is being actively exploited in the wild, the high CVSS score and the nature of the vulnerability (arbitrary command execution) suggest a strong potential for exploitation. Organizations using affected FortiAnalyzer or FortiManager products are strongly advised to review the advisory and apply the necessary patches or updates as soon as possible.
Fortinet has provided updated versions for the affected products. Users are urged to consult the official Fortinet PSIRT advisories for the most current information on affected versions and remediation steps. Applying these updates is crucial to mitigate the risk of unauthorized command execution and potential system compromise.
The ability for a low-privileged user to execute arbitrary commands is a critical security concern, as it bypasses normal access controls and can lead to significant damage. This incident underscores the importance of regular security patching and diligent monitoring of network security appliances, which often hold privileged positions within an organization's infrastructure.
This advisory details a separate OS Command Injection vulnerability (CWE-78) in the fgfmd daemon of FortiManager, distinct from the SQL injection flaw in FG-IR-26-178. Exploitation requires an attacker to possess a FortiManager cluster node's certificate and private key to execute unauthorized code, carrying a CVSSv3 score of 5.3.