Description
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiAnalyzer | 8.0.0 – ≤ 8.0.1, 7.6.0 – ≤ 7.6.7, 7.4.0 – ≤ 7.4.11, 7.2.0 – ≤ 7.2.12 | — |
| Fortinet | FortiManager | 8.0.0, 7.6.0 – ≤ 7.6.7, 7.4.0 – ≤ 7.4.11, 7.2.0 – ≤ 7.2.12 | — |
Advisories 2
- NCSC-2026-0488 Kwetsbaarheden verholpen in Fortinet FortiManager en FortiAnalyzer NCSC-NL (Netherlands) · Nov 12, 2026
- WID-SEC-2026-4489 Fortinet Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026