CVE-2026-23705CWE-89sql-injection

CVE-2026-23705

High · published October 13, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
22.5
In the wild
Unconfirmed
What it is

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00309 · 22.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-10-13T22:17Z
References (1)
https://fortiguard.fortinet.com/psirt/FG-IR-26-178 · [email protected]
EPSS history
Timeline
  • 15 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 13 OCT 17:37Z
    An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0…
    cvelistv5
  • 13 OCT 17:37Z
    An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0…
    cvelistv5