Skip to content
VulniPulse
Sign in
Advisory severityHigh7.9Fortinet

High [CVE-2025-46773 +3] Multiple Arbitrary File Read/Write via SQL Injection

This high-severity Fortinet advisory covers CVE-2025-46773 and CVE-2026-23705 and 2 more CVEs affecting FortiAnalyzer Cloud, FortiManager Cloud.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations. This bulletin covers 4 CVEs; its score, affected versions and guidance may apply to different issues within that bulletin.

FG-IR-26-178 Source published Source updated

VulniPulse record published

CVE-2025-46773CVE-2026-23705CVE-2026-23706CVE-2026-23707
Affected products & platforms
FortinetFortiManagerFortiAnalyzer
Open source advisory

Android app · Google Play

Monitor future Fortinet CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

CVSSv3 Score:

7.9

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests.

Revised on 2026-10-13 00:00:00

Affected versions
  • FortiAnalyzer FortiAnalyzer: 7.2 through 8.0 (vendor-listed versions)
  • FortiAnalyzer Cloud FortiAnalyzer Cloud: 7.2 through 7.6 (vendor-listed versions)
  • FortiManager FortiManager: 7.2 through 8.0 (vendor-listed versions)
  • FortiManager Cloud FortiManager Cloud: 7.2 through 8.0 (vendor-listed versions)

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Mitigation

The source record does not include mitigation steps. That is not a statement that no fix exists — read the vendor advisory below for the authoritative guidance.

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.