CVE-2022-26116: 
FortiNAC vulnerability analysis and mitigation

CVE-2022-26116 is a SQL injection vulnerability discovered in FortiNAC that was initially published on May 3, 2022. The vulnerability affects multiple versions of FortiNAC, including versions 9.2.0 through 9.2.2, 9.1.0 through 9.1.5, and all versions of 8.8, 8.7, 8.6, 8.5, and 8.3 (FortiGuard PSIRT).

The vulnerability is classified as an improper neutralization of special elements used in SQL commands (CWE-89) with a CVSSv3 score of 6.8, indicating a medium severity level. The issue allows an authenticated attacker to execute unauthorized code or commands through specifically crafted string parameters (FortiGuard PSIRT).

If successfully exploited, the vulnerability enables authenticated attackers to execute unauthorized code or commands on affected FortiNAC systems (FortiGuard PSIRT).

Fortinet has released multiple upgrade paths to address this vulnerability. Users can upgrade to FortiNAC version 10.0.0 or above, version 9.4.0 or above, version 9.2.3 or above, or version 9.1.6 or above to mitigate the issue. It's worth noting that FortiNAC 9.4 all versions and FortiNAC 7.2 all versions are not affected by this vulnerability (FortiGuard PSIRT).