SQL Injection Vulnerability in Fortinet FortiAnalyzer and FortiManager Products
CVE-2026-23706

5.9MEDIUM

Key Information:

Vendor

Fortinet
Status
Fortianalyzer Cloud
Fortimanager
Fortianalyzer
Vendor
CVE Published:
13 October 2026

What is CVE-2026-23706?

A vulnerability exists in Fortinet's FortiAnalyzer and FortiManager products due to improper neutralization of special elements in SQL commands. This flaw could allow a low privileged user to execute arbitrary commands through crafted requests, exposing systems to various security risks. Affected versions include FortiAnalyzer 7.6.0 to 7.6.4, 7.4.0 to 7.4.7, and all versions of 7.2, as well as multiple versions of FortiManager. For detailed information, refer to Fortinet's official advisory.

Affected Version(s)

FortiAnalyzer 7.6.0 <= 7.6.2

FortiAnalyzer 7.4.1 <= 7.4.6

FortiAnalyzer Cloud 7.6.2

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-178

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.