Fortinet FortiManager and FortiAnalyzer Vulnerable to Command Execution

Fortinet has released a security advisory detailing a critical vulnerability affecting its FortiManager and FortiAnalyzer products, as well as their cloud-based counterparts. The flaw, identified as CVE-2026-36595, stems from an "Improper neutralization of special elements used in a template engine" within the fortisoc component. This vulnerability falls under the CWE-134 category, specifically "Use of Externally-Controlled Format String."

The vulnerability carries a CVSSv3 score of 7.2, classifying it as high severity. Exploitation requires an authenticated attacker to send a specially crafted HTTP request to the affected systems. Successful exploitation could lead to the execution of unauthorized commands on the vulnerable devices, posing a significant risk to network security and data integrity.

The advisory lists a wide range of affected versions for both FortiAnalyzer and FortiAnalyzer Cloud. This includes versions 8.0.x, 7.6.x, 7.4.x, and 7.2.x for FortiAnalyzer, and corresponding cloud versions. The extensive list of affected versions highlights the broad potential impact of this vulnerability across many deployments.

Fortinet has indicated that the vulnerability was discovered internally by Loic Pantano of the Fortinet Product Security team, with assistance from the frontier AI model Claude Mythos. This internal discovery and reporting mechanism is a testament to Fortinet's ongoing efforts to identify and address security weaknesses within its product portfolio.

While the advisory does not explicitly detail the exact nature of the commands an attacker could execute, the potential for unauthorized command execution typically implies the ability to alter system configurations, exfiltrate data, or even gain deeper access to the network infrastructure managed by these devices. FortiManager and FortiAnalyzer are critical components for centralized management and log analysis, making their compromise a high-priority concern.

Fortinet has not yet released specific patches for this vulnerability in the advisory, but the extensive list of affected versions suggests that users should consult Fortinet's official advisories and product documentation for the latest information on mitigation and remediation steps. Users are strongly advised to update to the latest available versions as soon as patches are released to protect their environments.

This vulnerability underscores the importance of robust security practices for network management appliances. Organizations relying on Fortinet's management solutions should prioritize reviewing their security posture, ensuring strong authentication mechanisms are in place, and monitoring for any unusual activity on their FortiManager and FortiAnalyzer instances.