Vulnerability in Fortinet FortiManager Cloud

[ Description ]Official description

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4 may allow a low privileged user to execute arbitrary commands via crafted requests.

[ Fixes ]Fixes and patches

• Security bulletin: Fortinet FG-IR-26-176Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-176, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-177Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-177, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-182Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-182, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-179Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-179, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-178Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-178, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-185Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-185, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-181Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-181, cited by CERT-FR CERTFR-2026-AVI-1306

[ Advisories ]Government CERT advisories

• CERT-FR14 Oct 2026CERTFR-2026-AVI-1306

  Multiple vulnerabilities in Fortinet products Translated from French

  Multiple vulnerabilities have been discovered in Fortinet products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-106171CVE-2026-23705CVE-2026-23706+7 more CVEs
• BSI CERT-Bund13 Oct 2026WID-SEC-2026-3935

  Fortinet FortiAnalyzer and FortiManager: Multiple vulnerabilities allow SQL injection Translated from German

  CVE-2026-23705CVE-2026-23707CVE-2026-23706+1 more CVEs

[ References ]References

• fortiguard.fortinet.com/psirt/FG-IR-26-178