Other security products
CVE-2024-26012: OS command injection in FortiAP-S, FortiAP-W2 and others
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiAP-S 6.2 all verisons, and 6.4.0 through 6.4.9, FortiAP-W2 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2, FortiAP 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2 allow a local authenticated attacker to execute unauthorized code via the CLI.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| FortiAP-S 6.4.0 to 6.4.9 | 6.4.10 or later |
| FortiAP-S 6.2.0 to 6.2.6 | Upgrade past 6.2.6; see the advisory |
| FortiAP-W2 7.4.0 to 7.4.2 | 7.4.3 or later |
| FortiAP-W2 7.2.0 to 7.2.3 | 7.2.4 or later |
| FortiAP-W2 7.0.0 to 7.0.8 | Upgrade past 7.0.8; see the advisory |
| FortiAP-W2 6.4.0 to 6.4.10 | Upgrade past 6.4.10; see the advisory |
| FortiAP 7.4.0 to 7.4.2 | 7.4.3 or later |
| FortiAP 7.2.0 to 7.2.3 | 7.2.4 or later |
| FortiAP 7.0.0 to 7.0.7 | Upgrade past 7.0.7; see the advisory |
| FortiAP 6.4.3 to 6.4.9 | Upgrade past 6.4.9; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiAP-S 6.2 all verisons, and 6.4.0 through 6.4.9, FortiAP-W2 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2, FortiAP 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2 allow a local authenticated attacker to execute unauthorized code via the CLI.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.