SQL Injection Vulnerability in Fortinet FortiAnalyzer and FortiManager Products
CVE-2026-23707

6.5MEDIUM

Key Information:

Vendor: Fortinet
Status: Fortimanager Cloud; Fortianalyzer Cloud; Fortimanager; Fortianalyzer
Vendor: CVE Published:; 13 October 2026

What is CVE-2026-23707?

An SQL Injection vulnerability in various versions of Fortinet's FortiAnalyzer and FortiManager could allow a low privileged user to exploit the system by sending specially crafted requests. This vulnerability can lead to the execution of arbitrary commands on the affected system, potentially compromising its integrity and confidentiality. Users are advised to update their software to mitigatethe risks associated with this security issue.

Affected Version(s)

FortiAnalyzer 7.6.0 <= 7.6.4

FortiAnalyzer Cloud 7.6.2 <= 7.6.4

FortiManager 7.6.0 <= 7.6.4

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-178

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 13, 2026
Vulnerability Reserved
Jan 15, 2026

CVE-2026-23707 Data

JSON