Fortinet FortiAnalyzer: SQL injection allowing command execution

Summary

Fortinet FortiAnalyzer and FortiAnalyzer Cloud contain an SQL injection vulnerability (CWE-89) in several 7.2, 7.4 and 7.6 releases. According to the CVE description, a low-privileged user can use crafted requests to execute arbitrary commands. The CVSS base score is 8.8 in the CNA record; Fortinet rates the issue as High. Because FortiAnalyzer stores the logs of the whole environment, a successful attack would also expose or alter the security log record.

Affected

• FortiAnalyzer 7.6.0 to 7.6.4 (CNA record: up to 7.6.3)
• FortiAnalyzer 7.4.0 to 7.4.7
• FortiAnalyzer 7.2 (CNA record: 7.2.0 to 7.2.11)
• FortiAnalyzer Cloud 7.6.2 to 7.6.4 (CNA record: up to 7.6.3)
• FortiAnalyzer Cloud 7.4.1 to 7.4.7
• FortiAnalyzer Cloud 7.2.1 to 7.2.11 (CNA record: up to 7.2.12)
• The version ranges differ between the CNA record and the Fortinet advisory; verify against the advisory before scoping.
• Fortinet advisory FG-IR-26-178 reportedly lists FortiAnalyzer 8.0 as not affected.

Fixed in

• FortiAnalyzer 7.6: upgrade to 7.6.5 or later
• FortiAnalyzer 7.4: upgrade to 7.4.8 or later (CNA record also lists 7.4.10)
• FortiAnalyzer 8.0: 8.0.0 or later (per CNA record)
• FortiAnalyzer 7.2: no fixed in-branch release confirmed; migrate to a fixed release (CNA record lists 6.4.16 as upcoming for the 6.4 line)
• FortiAnalyzer Cloud 7.6: 7.6.5 or later
• FortiAnalyzer Cloud 7.4: 7.4.8 or later
• FortiAnalyzer Cloud 7.2: 7.2.12 or later per Fortinet advisory; the CNA record lists 7.2.13 as upcoming. Verify.
• Unknown whether the October 2026 security hardening releases fix this CVE.

Workaround

Unknown. No vendor workaround was found.

Exploitation

• No known exploitation in the wild at the time of research.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• CISA KEV status not verified against the live catalogue.
• No public proof of concept found; this does not rule one out.

Our recommendation

• Inventory all FortiAnalyzer and FortiAnalyzer Cloud instances and their exact versions.
• Upgrade to the fixed releases listed above, prioritising internet-exposed systems and 7.2 installations.
• Migrate 7.2 systems to a supported, fixed release, as no in-branch fix has been confirmed.
• Until patched, restrict GUI and management access to administrative networks and review accounts with low privileges.
• Monitor logs for unusual SQL errors, unexpected commands and logins from new sources.
• Check the Fortinet advisory and CISA KEV regularly for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Fortinet PSIRT FG-IR-25-246 (referenced advisory, not accessible during research) fortiguard.fortinet.com
• Fortinet PSIRT FG-IR-26-178 www.fortiguard.com
• Strix CVE record CVE-2025-46773 www.strix.ai
• SecurityOnline vulnerability overview securityonline.info
• CCB Belgium advisory on Fortinet FortiSIEM and related products ccb.belgium.be
• AVD (Aliyun) entry AVD-2025-46773 avd.aliyun.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:48.