Paper/Archive/CVE-2026-126262

CVE-2026-126262

Fortinet FortiAnalyzer — A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 thro…

CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets.

Affected

ProductAffectedFixed inSource

FortiAnalyzer8.0.0 – 8.0.1–CNA

FortiAnalyzer7.6.0 – 7.6.7–CNA

FortiAnalyzer7.4.0 – 7.4.11–CNA

FortiAnalyzer7.2.0 – 7.2.12–CNA

FortiManager8.0.0–CNA

FortiManager7.6.0 – 7.6.7–CNA

FortiManager7.4.0 – 7.4.11–CNA

FortiManager7.2.0 – 7.2.12–CNA

Scores by source

fortinet (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

References

reffortiguard.fortinet.com/psirt/FG-IR-26-276