Fortinet Fixes Multiple SQL Injection Vulnerabilities In FortiAnalyzer And FortiManager

Fortinet has released security updates addressing four vulnerabilities affecting multiple versions of FortiAnalyzer and FortiManager. The flaws involve SQL injection weaknesses that could potentially allow a low-privileged attacker to execute arbitrary commands or unauthorised code on vulnerable systems.

The most serious issue is tracked as CVE-2025-46773, which carries a CVSS v3.1 score of 7.9 out of 10 and is classified as High severity. Three additional vulnerabilities — CVE-2026-23705, CVE-2026-23706 and CVE-2026-23707 — were disclosed alongside it and are rated Medium severity.

Four Vulnerabilities Affect Fortinet Management Platforms

The security update addresses the following vulnerabilities:

Fortinet classifies all four vulnerabilities as issues involving improper neutralisation of special elements used in SQL commands.

In practical terms, specially crafted input may be processed in a way that allows an attacker to manipulate SQL operations unexpectedly.

Low-Privileged Users Could Potentially Exploit The Flaws

One of the concerning aspects of these vulnerabilities is that exploitation may be possible using a relatively low-privileged account.

A malicious user could potentially send crafted requests to a vulnerable FortiAnalyzer or FortiManager system. Successful exploitation may lead to arbitrary command execution or the execution of unauthorised code on the affected device.

That makes the vulnerabilities important even though they do not necessarily require an attacker to begin with full administrative privileges.

For organisations relying heavily on Fortinet's management infrastructure, compromising one of these systems could create a much wider security concern.

FortiAnalyzer And FortiManager Play Important Roles

FortiAnalyzer is commonly used to collect and analyse logs, events and security information from Fortinet environments.

FortiManager, meanwhile, provides centralised management for Fortinet devices and configurations.

Because both platforms sit close to an organisation's security infrastructure, vulnerabilities affecting them deserve particular attention.

Even if a vulnerability does not directly compromise every managed firewall or security appliance, gaining unauthorised access to a central management or analysis system could still expose valuable operational information.

No Evidence Of Active Exploitation So Far

As of the disclosure date, Fortinet had not identified evidence that the vulnerabilities were being actively exploited in the wild.

That is encouraging, but organisations should not treat the absence of known exploitation as a reason to delay patching.

Once vulnerabilities become publicly known, attackers may begin analysing them and searching for exposed systems.

Fortinet therefore recommends installing the appropriate fixed releases as soon as possible.

FortiAnalyzer 7.6 Is Affected

FortiAnalyzer installations running versions:

are affected.

The recommended solution is to upgrade to:

Administrators should verify the exact maintenance version rather than simply confirming that they are running the 7.6 branch.

FortiAnalyzer 7.4 Requires An Upgrade

FortiAnalyzer 7.4 installations are affected from version:

The recommended fixed release is:

Any organisation running an older 7.4 build should therefore plan an upgrade as soon as possible.

All FortiAnalyzer 7.2 Versions Are Affected

For the standard FortiAnalyzer 7.2 branch, the situation is more significant.

All versions of FortiAnalyzer 7.2 are listed as affected.

Instead of providing another fixed release within the branch, the recommended action is to:

Organisations still using FortiAnalyzer 7.2 should therefore review their upgrade path rather than waiting for another maintenance patch.

FortiAnalyzer Cloud Is Also Included

The vulnerabilities also affect several FortiAnalyzer Cloud versions.

Affected releases include:

Recommended fixed versions are:

Cloud deployments should therefore be checked just as carefully as locally managed systems.

FortiManager 7.6 Is Vulnerable

FortiManager 7.6 installations running:

are affected.

The recommended solution is:

Because FortiManager can centrally manage multiple Fortinet devices, patching vulnerable installations should be treated as an important priority.

FortiManager 7.4 Requires Version 7.4.7 Or Later

Affected FortiManager 7.4 versions include:

The recommended fixed release is:

Administrators should also remember to check secondary or less frequently used systems rather than focusing only on the primary production instance.

FortiManager 7.2 Needs Migration

All FortiManager 7.2 versions are listed as affected.

The recommended response is:

This means organisations still relying on the 7.2 branch should consider moving to a newer supported version rather than remaining on the affected release family.

FortiManager Cloud 7.6 Is Also Affected

FortiManager Cloud versions:

are affected by the disclosed vulnerabilities.

The recommended fix is:

Organisations using cloud-based Fortinet management should therefore verify their deployed version and confirm that the required update has been applied.

There Is No Workaround

One of the most important details is that Fortinet has not provided any workaround for these vulnerabilities.

That means administrators cannot rely on a temporary configuration change while postponing remediation.

The recommended response is to upgrade to the relevant fixed release as soon as possible.

For FortiAnalyzer and FortiManager 7.2, that means moving away from the affected branch entirely.

Why SQL Injection Remains Serious

SQL injection is one of the oldest application security vulnerabilities, but it can still have serious consequences when input is not handled correctly.

The problem occurs when attacker-controlled data influences SQL commands in ways the application did not intend.

Depending on the vulnerability, this can allow attackers to manipulate data, interfere with application behaviour or trigger additional actions on the affected system.

In this case, the disclosed flaws may potentially allow command execution or unauthorised code execution, which increases their security impact considerably.

Management Platforms Should Be Patched Quickly

FortiAnalyzer and FortiManager should be treated as critical infrastructure within Fortinet environments.

These platforms provide visibility into security activity and centralised control over managed devices.

A vulnerability affecting either system can therefore create a broader operational risk than one affecting an ordinary endpoint application.

Organisations should ensure that both production systems and less visible environments such as test, backup or disaster-recovery deployments are included in the patching process.

Older Versions Deserve Particular Attention

The fact that all versions within the FortiAnalyzer 7.2 and FortiManager 7.2 branches are affected is particularly important.

Older platforms may remain in service because they are considered stable or because organisations are hesitant to introduce changes.

However, security vulnerabilities can eventually make remaining on an older branch more risky than performing the upgrade itself.

Where the recommended solution is migration to a fixed release, organisations should treat that as a signal that continued reliance on the older branch is no longer appropriate.

Final Thoughts

Fortinet's latest security updates address four SQL injection vulnerabilities affecting FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud.

The most serious issue, CVE-2025-46773, carries a CVSS score of 7.9, while CVE-2026-23705, CVE-2026-23706 and CVE-2026-23707 are rated Medium severity.

A low-privileged attacker could potentially exploit the vulnerabilities using crafted requests, resulting in arbitrary command execution or unauthorised code execution on vulnerable systems.

Fortinet has not identified active exploitation at this stage, but there are also no workarounds available. Organisations should therefore upgrade affected systems immediately to the appropriate fixed versions, while deployments remaining on affected 7.2 branches should migrate to a supported release.

For systems as central to security operations as FortiAnalyzer and FortiManager, delaying these updates introduces unnecessary risk.