SQL Injection Vulnerability in Fortinet FortiAnalyzer and FortiManager Products
CVE-2025-61848

6.8MEDIUM

Key Information:

Vendor: Fortinet
Status: Fortimanager; Fortianalyzer; Fortimanager Cloud; Fortianalyzer Cloud
Vendor: CVE Published:; 14 April 2026

What is CVE-2025-61848?

An SQL injection vulnerability in Fortinet FortiAnalyzer and FortiManager products allows an authenticated attacker with administrative privileges to exploit the JSON RPC API. This may result in the execution of unauthorized commands or code, potentially compromising the security and integrity of the affected systems.

Affected Version(s)

FortiAnalyzer 7.6.0 <= 7.6.3

FortiAnalyzer Cloud 7.6.2 <= 7.6.3

FortiManager 7.6.0 <= 7.6.3

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-111

CVSS V3.1

Score:

6.8

Severity:

MEDIUM

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 14, 2026
Vulnerability Reserved
Oct 1, 2025

CVE-2025-61848 Data

JSON