CVE-2026-126262 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4...
CriticalCVSS 9.3
- Published
- Updated
- Exploit status
- No public exploit known
Description
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortianalyzer | >= 8.0.0, <= 8.0.1 | No fix listed |
| fortinet fortianalyzer | >= 7.6.0, <= 7.6.7 | No fix listed |
| fortinet fortianalyzer | >= 7.4.0, <= 7.4.11 | No fix listed |
| fortinet fortianalyzer | >= 7.2.0, <= 7.2.12 | No fix listed |
| fortinet fortimanager | = 8.0.0 | No fix listed |
| fortinet fortimanager | >= 7.6.0, <= 7.6.7 | No fix listed |
| fortinet fortimanager | >= 7.4.0, <= 7.4.11 | No fix listed |
| fortinet fortimanager | >= 7.2.0, <= 7.2.12 | No fix listed |