CVE-2026-23705: 
Fortinet FortiManager vulnerability analysis and mitigation

CVE-2026-23705 is an SQL Injection vulnerability (CWE-89) in Fortinet FortiAnalyzer and FortiManager that may allow a low-privileged authenticated user to execute arbitrary commands via crafted requests. The vulnerability is part of advisory FG-IR-26-178, which also covers CVE-2025-46773, CVE-2026-23706, and CVE-2026-23707. Affected products include FortiAnalyzer 7.2 (all versions), 7.4.0–7.4.7, and 7.6.0–7.6.4; FortiManager 7.2 (all versions), 7.4.0–7.4.6, and 7.6.0–7.6.4; as well as their respective Cloud variants. The vulnerability was disclosed on October 13, 2026, and carries a CVSS v3.1 base score of 7.2–7.9 (High), depending on the scoring source (FortiGuard Advisory, GitHub Advisory).

The root cause is improper neutralization of special elements in SQL commands (CWE-89), where user-supplied input is incorporated into SQL queries without adequate sanitization or parameterization. An authenticated low-privileged user can craft malicious requests to the GUI component that inject SQL syntax, ultimately enabling arbitrary command execution on the underlying system — a technique mapped to CAPEC-108 (Command Line Execution through SQL Injection) and CAPEC-470 (Expanding Control over the Operating System from the Database). The attack is network-based, requires no user interaction, and exploits the application's failure to properly separate data from SQL command logic. The vulnerability was internally discovered by Jaguar Perlas of Burnaby Infosec team and David Maciejack from Fortinet's Product Security team (FortiGuard Advisory).

Successful exploitation allows a low-privileged authenticated attacker to execute arbitrary commands on affected FortiAnalyzer or FortiManager systems, resulting in high impact to confidentiality, integrity, and availability. An attacker could read or write arbitrary files, manipulate security management configurations, access sensitive log data, or pivot to managed network devices. Given that FortiAnalyzer and FortiManager are central network security management platforms, compromise could have cascading effects across the entire managed infrastructure (FortiGuard Advisory, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. Fortinet has marked the vulnerability as "Known Exploited: No" in its advisory. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (FortiGuard Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing or internally accessible FortiAnalyzer or FortiManager instances running affected versions (7.2.x, 7.4.0–7.4.7, or 7.6.0–7.6.4) using network scanning or Shodan/Censys queries.
2. Authentication: Obtain low-privileged credentials to the target system through phishing, credential stuffing, or insider access — exploitation requires at least a low-privilege account.
3. Craft malicious request: Construct an HTTP request targeting the vulnerable GUI component that includes SQL injection payloads in user-controlled input fields, injecting SQL syntax to alter the intended query logic.
4. SQL injection to command execution: Leverage the injected SQL to invoke database functions or stored procedures capable of executing OS-level commands (e.g., via SQL EXEC, xp_cmdshell, or equivalent), escalating from database access to arbitrary command execution on the host.
5. Post-exploitation: Use achieved command execution to read/write arbitrary files, establish persistence, exfiltrate sensitive configuration or log data, or pivot to managed network devices (FortiGuard Advisory).

• Network: Unusual or malformed HTTP requests to FortiAnalyzer/FortiManager GUI endpoints containing SQL metacharacters (e.g., ', --, UNION, SELECT, EXEC) in parameter values; unexpected outbound connections from the management server to external IPs.
• Logs: FortiAnalyzer/FortiManager access logs showing repeated or anomalous API/GUI requests from low-privileged accounts; database error messages or stack traces in application logs indicating SQL parsing failures.
• File System: Unexpected new files or modified configuration files in the FortiAnalyzer/FortiManager installation directories; unauthorized file reads or writes in sensitive directories.
• Process: Unusual child processes spawned by the FortiAnalyzer or FortiManager application process (e.g., shell interpreters, network utilities like curl or wget).
• Authentication: Low-privileged accounts performing actions inconsistent with their role, such as accessing administrative functions or generating high volumes of API requests.

Fortinet has released patched versions to address this vulnerability. Organizations should upgrade to the following fixed releases: FortiAnalyzer 7.6.5 or above, FortiAnalyzer 7.4.8 or above (FortiAnalyzer 7.2 users must migrate to a fixed release); FortiManager 7.6.5 or above, FortiManager 7.4.7 or above (FortiManager 7.2 users must migrate to a fixed release). For Cloud variants, upgrade FortiAnalyzer Cloud to 7.6.5+, 7.4.8+, or 7.2.12+; FortiManager Cloud 7.6 to 7.6.5+. As interim mitigations, restrict access to FortiAnalyzer and FortiManager administrative interfaces to trusted users and networks only, and apply network segmentation to limit exposure. Monitor system logs for suspicious SQL-related activity or anomalous administrative actions (FortiGuard Advisory).

The vulnerability was internally discovered and reported by Fortinet's own security teams (Burnaby Infosec and Product Security), indicating proactive internal security research. No significant public researcher commentary, social media discussion, or notable media coverage has been identified at this time beyond standard vulnerability database aggregation (FortiGuard Advisory).