An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') flaw in FortiAnalyzer and FortiManager services enables low‑privileged users to submit crafted requests that result in the execution of arbitrary commands on the affected appliance. The flaw stems from improper neutralization of special elements in SQL statements, allowing the attacker to inject additional SQL that can alter system state or facilitate further exploitation. The consequence remains loss of confidentiality, integrity, and availability of the Fortinet device, potentially enabling full system control.

The vulnerability affects Fortinet FortiAnalyzer firmware versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, and 7.2.0 through 7.2.13, as well as FortiManager firmware versions 7.4.0 through 7.4.6 and all 7.2 releases. The fix is provided in FortiAnalyzer 7.6.3 or later (or 7.4.7 or later if 7.6 series is unavailable) and FortiManager 7.6.0 or later (or 7.4.7 or later if 7.6 series is unavailable).

The CVSS score of 6.5 marks this a moderate severity vulnerability. The EPSS score is < 1 %, indicating a very low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack can be executed remotely by an authenticated low‑privileged user through the web or API interfaces; exploitation requires only the ability to submit crafted requests to the affected service.