A SQL injection flaw in Fortinet FortiAnalyzer and FortiManager allows a user with low privileges to craft requests that execute arbitrary commands on the device. The attacker can exploit the improper neutralization of special elements in SQL statements to gain the ability to run system commands, potentially leading to further compromise of the network stack, data access, or service disruption.

FortiAnalyzer versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, and all 7.2.x releases, as well as FortiAnalyzer Cloud 7.6.2 through 7.6.4, 7.4.1 through 7.4.7, and 7.2.1 through 7.2.11. The same vulnerability covers FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.6, and all 7.2.x versions, together with FortiManager Cloud 7.6.2 through 7.6.4.

The CVSS score of 6.5 indicates moderate severity. EPSS is not reported, and the vulnerability is not listed in the CISA KEV catalog, so the current explosive potential is unclear, but the flaw does enable command execution from a low‑privileged context. Attackers are inferred to use remote HTTP/Web requests to reach the vulnerable interfaces, which makes the attack vector network‑based. Because command execution can lead to larger system compromise, it remains a high‑priority issue for administrators to address.