OTPulse

Multiple Arbitrary File Read/Write via SQL Injection

Plan PatchCVSS 7.9FG-IR-26-178Oct 13, 2026
Fortinet
IT in OT - Fortinet products are commonly deployed at IT/OT network boundaries
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Multiple SQL Injections

What this means
What could happen
Could allow an attacker to read or modify database contents
Who's at risk
Organizations in critical infrastructure using Fortinet equipment
How it could be exploited
Attacker on the corporate network or internet could reach this device with basic access credentials. The attack is straightforward with no special conditions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (10)
10 with fix
ProductAffected VersionsFix Status
FortiAnalyzer7.6.0 - 7.6.47.6.5+
FortiAnalyzer7.4.0 - 7.4.77.4.8+
FortiAnalyzer7.2 all versionsMigrate to fixed release
FortiAnalyzer Cloud7.6.2 - 7.6.47.6.5+
FortiAnalyzer Cloud7.4.1 - 7.4.77.4.8+
FortiAnalyzer Cloud7.2.1 - 7.2.117.2.12+
FortiManager7.6.0 - 7.6.47.6.5+
FortiManager7.4.0 - 7.4.67.4.7+
View full vendor advisory
API: /api/v1/advisories/dd5f734d-1e36-4254-8e56-dbcbe248c595

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Multiple Arbitrary File Read/Write via SQL Injection | CVSS 7.9 - OTPulse