Fortinet patches SQL injection in FortiAnalyzer, FortiManager, FortiMail

Fortinet patches SQL injection in FortiAnalyzer, FortiManager, FortiMail

13 October 2026: Fortinet has fixed four SQL injection flaws in FortiAnalyzer and FortiManager that let a user with low privileges execute arbitrary commands through crafted requests, and a separate SQL injection in FortiMail webmail that allows privilege escalation. Both advisories are rated high, both were found internally, and Fortinet lists neither as exploited. There is no virtual patch, so the fix is an upgrade, and on the 7.2 line of FortiAnalyzer and FortiManager it means moving to a newer release altogether.

FortiAnalyzer and FortiManager versions

Advisory FG-IR-26-178 covers CVE-2025-46773, CVE-2026-23705, CVE-2026-23706 and CVE-2026-23707, with a CVSS score of 7.9. The fixed releases are:

• FortiAnalyzer 7.6.0 to 7.6.4: upgrade to 7.6.5
• FortiAnalyzer 7.4.0 to 7.4.7: upgrade to 7.4.8
• FortiManager 7.6.0 to 7.6.4: upgrade to 7.6.5
• FortiManager 7.4.0 to 7.4.6: upgrade to 7.4.7
• FortiAnalyzer and FortiManager 7.2, all versions: migrate to a fixed release

The cloud services are affected too: FortiAnalyzer Cloud 7.6.2 to 7.6.4, 7.4.1 to 7.4.7 and 7.2.1 to 7.2.11 (fixed in 7.6.5, 7.4.8 and 7.2.12), and FortiManager Cloud 7.6.2 to 7.6.4. Version 8.0 of both products is not affected.

FortiMail webmail

Advisory FG-IR-26-184 covers CVE-2025-57739, scored 7.7. An authenticated attacker can send crafted HTTP requests to webmail and execute unauthorised code or commands. Fixed versions are FortiMail 7.6.4, 7.4.6 and 7.2.9; 8.0 is not affected. Fortinet says it fixed FortiMail Cloud in the first quarter of 2026, so cloud customers have nothing to do.

Why the authenticated label is not much comfort

Both flaws need a logged-in user, but FortiAnalyzer and FortiManager are the boxes that hold the logs and the configuration for an organisation's whole Fortinet estate. A low-privileged analyst account, or one stolen through phishing, becomes a route to command execution on the management plane. Fortinet management products have been targeted before: a FortiManager flaw known as FortiJump was exploited as a zero-day in 2024.

Teams that cannot upgrade straight away can reduce the exposure by limiting who holds accounts on these devices, removing stale analyst and API accounts, and keeping the management interfaces off networks that ordinary users reach. On FortiMail, webmail is the affected component, so an appliance that does not offer webmail to users is less exposed, although Fortinet does not list that as a workaround.

The Canadian Centre for Cyber Security's summary of the same day lists two further Fortinet advisories, FG-IR-26-180 and FG-IR-26-185, affecting other products; we have not reviewed those here.

Fortinet in our catalogue

We list Fortinet as a company. Our SIEM category, where FortiAnalyzer competes, lists 15 products, including IBM QRadar SIEM and LogPoint. Our email security category lists 11, including Mimecast Email Security.

Related on TrustList:

• Elastic patches 14 flaws across Elasticsearch, Kibana and Endpoint
• Splunk Enterprise fixes a critical Patroni flaw and 20 other bugs

Sources

• Fortinet PSIRT: FG-IR-26-178, multiple arbitrary file read/write via SQL injection, 13 October 2026
• Fortinet PSIRT: FG-IR-26-184, SQL injection in FortiMail webmail, 13 October 2026
• Canadian Centre for Cyber Security: Fortinet security advisory AV26-1037, 13 October 2026