An improper neutralization of special characters in SQL commands permits a privileged authenticated attacker to manipulate the JSON RPC API. The flaw is a classic SQL injection (CWE‑89) that can be leveraged to execute unauthorized code or commands on the device. An attacker can read, modify, or delete data, potentially compromising the confidentiality, integrity, and availability of the management services.

The vulnerability is present in Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud. Affected FortiAnalyzer versions include 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, all releases of 7.2 and 7.0. The same version ranges apply to FortiAnalyzer Cloud. FortiManager and FortiManager Cloud share identical affected versions, covering 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, all 7.2 and 7.0 releases.

The CVSS score of 6.8 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a privileged authenticated attacker who can access the JSON RPC interface, which is normally restricted to administrators. The likely attack vector is through the management API that accepts JSON RPC payloads. If an attacker gains such access, they can execute arbitrary code or commands on the device, potentially leading to full compromise of the managed network.