An improper neutralization of special elements used in SQL commands in Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiManager, and FortiManager Cloud may allow a privileged authenticated attacker to execute unauthorized code or commands via the JSON RPC API. The flaw is a classic SQL injection (CWE‑89) that can enable unauthorized data modification, deletion, or execution of arbitrary commands, thereby compromising confidentiality, integrity, and availability of the device’s management services.

The vulnerability is present in Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiAnalyzer-BigData, FortiManager, and FortiManager Cloud. Affected FortiAnalyzer versions include 7.6.0‑7.6.4, 7.4.0‑7.4.8, and all 7.2 and 7.0 releases. Corresponding FortiAnalyzer Cloud versions 7.6.2‑7.6.3 are affected while FortiAnalyzer-BigData versions 7.6.0‑7.6.1 and 7.4.0‑7.4.5 are impacted. FortiManager and FortiManager Cloud share identical affected versions, covering 7.6.0‑7.6.4, 7.4.0‑7.4.8, all 7.2 and 7.0 releases.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a privileged authenticated attacker who can access the JSON RPC interface, typically restricted to administrators. The likely attack vector is via the management API that accepts JSON RPC payloads. If an attacker gains such access, they can execute arbitrary code or commands on the device, potentially leading to full compromise of the managed network.