CVE-2026-126262 PUBLISHED

Assigner: fortinet
Reserved: 10.11.2026 Published: 11.11.2026 Updated: 12.11.2026

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CVSS Score: 9.3

Product Status

Vendor Fortinet
Product FortiAnalyzer
Versions Default: unaffected
  • affected from 8.0.0 to 8.0.1 (incl.)
  • affected from 7.6.0 to 7.6.7 (incl.)
  • affected from 7.4.0 to 7.4.11 (incl.)
  • affected from 7.2.0 to 7.2.12 (incl.)
Vendor Fortinet
Product FortiManager
Versions Default: unaffected
  • Version 8.0.0 is affected
  • affected from 7.6.0 to 7.6.7 (incl.)
  • affected from 7.4.0 to 7.4.11 (incl.)
  • affected from 7.2.0 to 7.2.12 (incl.)

Solutions

Upgrade to FortiManager version 8.0.1 or above Upgrade to FortiManager version 7.6.8 or above Upgrade to FortiManager version 7.4.12 or above Upgrade to FortiManager version 7.2.13 or above Upgrade to FortiAnalyzer version 8.0.2 or above Upgrade to FortiAnalyzer version 7.6.8 or above Upgrade to FortiAnalyzer version 7.4.12 or above Upgrade to FortiAnalyzer version 7.2.13 or above

References

Problem Types

  • Execute unauthorized code or commands CWE