On 13 October 2026, Fortinet published advisory FG-IR-26-178 describing SQL injection (CWE-89) vulnerabilities in FortiAnalyzer, FortiManager and their cloud versions. The vulnerabilities allow a low-privileged user to execute arbitrary commands via specially crafted requests to the graphical interface. The advisory aggregates four CVE identifiers and has been assigned an overall CVSSv3 score of 7.9 (High) by Fortinet; however, individual scores for specific CVEs in public registries differ — from 6.5 to 8.8. Organizations using affected 7.2, 7.4 and 7.6 branches should immediately update or migrate to fixed releases.
Technical details of the vulnerabilities
The advisory covers four CVEs: CVE-2025-46773, CVE-2026-23705, CVE-2026-23706 and CVE-2026-23707. All of them are classified as SQL injection (CWE-89) and are related to the GUI component. The attack requires authentication — the attacker needs a low-privileged account. Successful exploitation results in the execution of unauthorized code or commands, including arbitrary file read and write.
Fortinet has given the advisory an overall rating of CVSSv3 7.9 (High). However, this score should not be applied to each of the four CVEs individually: according to the entry in the NVD for CVE-2025-46773, the CNA score is 8.8 (CVSS vector: 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the CVE.org entry for CVE-2026-23707 records a score of 6.5 (Medium). This means that the actual severity of individual vulnerabilities covered by the advisory varies significantly.
Discrepancy in the mapping of CVE-2025-46773
CVE-2025-46773 deserves separate attention: although advisory FG-IR-26-178 includes this identifier in its list, the NVD entry for this CVE points to a different Fortinet advisory — FG-IR-25-246 — and describes a narrower scope of affected products (FortiAnalyzer and FortiAnalyzer Cloud only). The available data does not allow us to definitively determine whether this is a cross-reference or an error in the mapping. When planning remediation, it is recommended to take both advisories into account.
Affected versions and update recommendations
The matrix of affected versions differs between products and deployment models. Version 8.0 branches of all products are not affected.
FortiAnalyzer (on-premises)
- 7.6.0–7.6.4 — update to 7.6.5 or later
- 7.4.0–7.4.7 — update to 7.4.8 or later
- 7.2 (all versions) — migrate to a fixed release
FortiManager (on-premises)
- 7.6.0–7.6.4 — update to 7.6.5 or later
- 7.4.0–7.4.6 — update to 7.4.7 or later
- 7.2 (all versions) — migrate to a fixed release
FortiAnalyzer Cloud
- 7.6.2–7.6.4 — update to 7.6.5 or later
- 7.4.1–7.4.7 — update to 7.4.8 or later
- 7.2.1–7.2.11 — update to 7.2.12 or later
FortiManager Cloud
- 7.6.2–7.6.4 — update to 7.6.5 or later
- Branches 8.0, 7.4 and 7.2 — not affected
A critically important point: for on-premises deployments of FortiAnalyzer and FortiManager, the 7.2 branches do not have a patch within their own line — Fortinet recommends a full migration to a fixed release. This significantly complicates the update process compared to the 7.4 and 7.6 branches, where a standard update is sufficient. The cloud versions of the products have narrower ranges of affected versions and specific target releases for all branches.
Impact assessment
FortiAnalyzer and FortiManager are central security management components in Fortinet infrastructures. FortiAnalyzer aggregates logs and analytics from all Fortinet devices in the network, while FortiManager manages configurations and policies. Compromise of either product potentially gives an attacker access to security logs, firewall configurations and policies for the entire infrastructure.
According to the Fortinet advisory, the vulnerability was discovered by the company’s internal researchers, and the exploitation status is listed as “No”. However, no independent confirmation of the absence of exploitation was found in the available materials — the exploitation status should be considered undetermined, rather than guaranteed safe. None of the four CVEs has been added to the CISA KEV catalog at the time of publication.
We have previously covered vulnerabilities in Fortinet products — in particular, the FortiSandbox authentication bypass with a CVSS score of 9.6. The current advisory confirms that Fortinet’s security management product line remains under close scrutiny by researchers.
Practical recommendations
- Identify affected deployments. Check the versions of FortiAnalyzer and FortiManager (including cloud) against the matrix above. Pay attention to the differences in affected ranges between on-premises and cloud products.
- Prioritize the 7.2 branch. Deployments on the 7.2 branch (on-premises) require migration rather than an update — plan this process as a priority, since it is the most labor-intensive.
- Update the 7.4 and 7.6 branches to the specified fixed versions (7.4.7/7.4.8 and 7.6.5 respectively, depending on the product).
- Audit accounts with access to the FortiAnalyzer and FortiManager GUI. Since the attack requires authentication, minimizing the number of accounts and applying the principle of least privilege reduces the attack surface.
- Track both advisories — FG-IR-26-178 and FG-IR-25-246 — for a full understanding of the scope of affected products associated with CVE-2025-46773.
Given that FortiAnalyzer and FortiManager manage the configurations and logs of the entire security infrastructure, updating these components should take priority over updating endpoint devices. Organizations on the 7.2 branch should start migration planning immediately, and administrators of the 7.4 and 7.6 branches should apply the available patches in the next maintenance window.
