This vulnerability is an SQL injection flaw caused by improper neutralization of special elements in SQL commands. An authenticated attacker who can reach the FortiNDR HTTP API can send specifically crafted HTTP requests that trigger execution of unauthorized SQL commands or code, potentially compromising data integrity and confidentiality.

Fortinet FortiNDR devices running versions 7.0 through 7.6.2 are affected, including all releases of 7.0, 7.1, 7.2, 7.4 (up to 7.4.9), and 7.6 (up to 7.6.2).

The CVSS score of 4.9 indicates moderate severity. The EPSS score of less than 1% shows a low probability of exploitation, but its presence in the CVE list indicates it could be attempted in environments where an attacker has authenticated access. Because exploitation requires valid credentials and access to the FortiNDR API, the attack vector is internal or VPN‑based traffic that can reach the HTTP endpoints. The vulnerability is not listed in the CISA KEV catalog, so no known active exploitation has been reported.