An SQL injection flaw exists in Fortinet FortiAnalyzer and FortiAnalyzer Cloud. The vulnerability stems from improper neutralization of special elements in SQL statements (CWE‑89). When an attacker crafts a malicious request, the application incorporates the input directly into an SQL query, allowing arbitrary SQL commands to be executed. The result is that a low‑privileged user can run system commands on the device, potentially compromising the integrity and confidentiality of the appliance.

Vulnerable products include Fortinet FortiAnalyzer versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, and all 7.2 releases. The FortiAnalyzer Cloud is affected for versions 7.6.2 through 7.6.4, 7.4.1 through 7.4.7, and 7.2.1 through 7.2.11. These versions expose a web or API interface that accepts user input.

The CVSS score of 7.9 indicates a high severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, but the presence of an injection flaw with potential for command execution is a serious risk. The attack vector is inferred to be remote, as the flaw is accessed through network‑bound web or API endpoints. Exploitation would require the attacker to send a crafted request to the target appliance; no authentication escalation is explicitly stated, so a user with low privileges on the management interface is sufficient. Because the flaw can lead to arbitrary command execution, successful exploitation could allow an attacker to take control of the device, exfiltrate data, or pivot to other systems.