PT-2026-32653 · Fortinet · Fortianalyzer+3

Published 2026-04-14 · Updated 2026-04-14 · CVE-2025-61848

Mitre

CVSS v3.1

7.2

High

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.8, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.0 through 7.4.8, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions may allow a privileged authenticated attacker to execute unauthorized code or commands via JSON RPC API

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-61848

Affected Products

Fortianalyzer

Fortianalyzer Cloud

Fortimanager

Fortimanager Cloud

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2025-61848 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-26-111 · Note