PT-2026-24229 · Fortinet · Fortianalyzer+3

Published 2026-03-10 · Updated 2026-03-17 · CVE-2025-48418

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiAnalyzer versions 6.4 through 7.6.3 Fortinet FortiAnalyzer Cloud versions 6.4 through 7.6.2 Fortinet FortiManager versions 6.4 through 7.6.3 Fortinet FortiManager Cloud versions 6.4 through 7.6.3 Fortinet FortiAnalyzer versions 7.0.0 through 7.0.14 Fortinet FortiAnalyzer Cloud versions 7.0.1 through 7.0.14 Fortinet FortiManager versions 7.0.0 through 7.0.14 Fortinet FortiManager Cloud versions 7.0.1 through 7.0.14 Fortinet FortiAnalyzer versions 7.2.0 through 7.2.10 Fortinet FortiAnalyzer Cloud versions 7.2.1 through 7.2.10 Fortinet FortiManager versions 7.2.0 through 7.2.10 Fortinet FortiManager Cloud versions 7.2.1 through 7.2.10 Fortinet FortiAnalyzer versions 7.4.0 through 7.4.7 Fortinet FortiAnalyzer Cloud versions 7.4.1 through 7.4.7 Fortinet FortiManager versions 7.4.0 through 7.4.7 Fortinet FortiManager Cloud versions 7.4.1 through 7.4.7 Fortinet FortiAnalyzer versions 7.6.0 through 7.6.3 Fortinet FortiAnalyzer Cloud version 7.6.2 Fortinet FortiManager versions 7.6.0 through 7.6.3 Fortinet FortiManager Cloud versions 7.6.2 through 7.6.3

Description A hidden functionality exists in Fortinet FortiAnalyzer and FortiManager products. This issue involves the presence of undocumented configuration commands. Exploitation may allow an attacker with read-only access and Command Line Interface (CLI) access to elevate their privileges.

Recommendations Fortinet FortiAnalyzer versions 6.4 through 7.6.3 should be updated. Fortinet FortiAnalyzer Cloud versions 6.4 through 7.6.2 should be updated. Fortinet FortiManager versions 6.4 through 7.6.3 should be updated. Fortinet FortiManager Cloud versions 6.4 through 7.6.3 should be updated. Fortinet FortiAnalyzer versions 7.0.0 through 7.0.14 should be updated. Fortinet FortiAnalyzer Cloud versions 7.0.1 through 7.0.14 should be updated. Fortinet FortiManager versions 7.0.0 through 7.0.14 should be updated. Fortinet FortiManager Cloud versions 7.0.1 through 7.0.14 should be updated. Fortinet FortiAnalyzer versions 7.2.0 through 7.2.10 should be updated. Fortinet FortiAnalyzer Cloud versions 7.2.1 through 7.2.10 should be updated. Fortinet FortiManager versions 7.2.0 through 7.2.10 should be updated. Fortinet FortiManager Cloud versions 7.2.1 through 7.2.10 should be updated. Fortinet FortiAnalyzer versions 7.4.0 through 7.4.7 should be updated. Fortinet FortiAnalyzer Cloud versions 7.4.1 through 7.4.7 should be updated. Fortinet FortiManager versions 7.4.0 through 7.4.7 should be updated. Fortinet FortiManager Cloud versions 7.4.1 through 7.4.7 should be updated. Fortinet FortiAnalyzer versions 7.6.0 through 7.6.3 should be updated. Fortinet FortiAnalyzer Cloud version 7.6.2 should be updated. Fortinet FortiManager versions 7.6.0 through 7.6.3 should be updated. Fortinet FortiManager Cloud versions 7.6.2 through 7.6.3 should be updated.

Fix

Hidden Functionality

Weakness Enumeration

CWE-1242

CWE-912

Related Identifiers

BDU:2026-03037

CVE-2025-48418

Affected Products

Fortianalyzer

Fortianalyzer Cloud

Fortimanager

Fortimanager Cloud

References · 8

• https://bdu.fstec.ru/vul/2026-03037 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48418 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-26-081 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48418 · Vendor Advisory
• https://twitter.com/CVEnew/status/2033994315157123443 · Twitter Post
• https://twitter.com/infoflowcloud/status/2033995975123993040 · Twitter Post
• https://t.me/cveNotify/155368 · Telegram Post
• https://twitter.com/dailycve/status/2032282564291862553 · Twitter Post