FortiManager and FortiAnalyzer

CVE-2025-46773: SQL injection in FortiAnalyzer, FortiAnalyzer Cloud

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.

Published 13 Oct 2026Fortinet advisory FG-IR-25-246

ExploitedNot in CISA KEV

Ransomware useNot reportedPer CISA

SeverityHIGHCVSS 3.1 7.9

EPSS0.32%Chance of exploitation in 30 days

Public exploitNot tracked

FixAvailable

Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.

Affected and fixed versions

Product / branch	Fixed in
FortiAnalyzer Cloud 7.6.2 to 7.6.3	7.6.5 or later
FortiAnalyzer Cloud 7.4.1 to 7.4.7	7.4.8 or later
FortiAnalyzer Cloud 7.2.1 to 7.2.12	7.2.13 (upcoming) or later
FortiAnalyzer 7.6.0 to 7.6.3	7.6.5 or later
FortiAnalyzer 7.4.0 to 7.4.7	7.4.8 or later
FortiAnalyzer 7.2.0 to 7.2.11	Upgrade past 7.2.11; see the advisory

Always confirm against the vendor advisory, which lists every fixed hotfix.

In short

A SQL injection flaw in FortiManager and FortiAnalyzer allows a low-privileged user to execute arbitrary commands by sending crafted requests over the network. This vulnerability requires no user interaction and enables an attacker to run unauthorized code on the system.

Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.

The vendor's description

Sources

KEV status, EPSS score and vendor data refreshed automatically, last on 20 Oct 2026.