Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1019
_____________________________________________________________________

DATE                : 14/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running FortiManager versions prior to
                                      8.0.1, 7.6.7,
                    FortiManager Cloud versions prior to 7.6.7,
                    FortiAnalyzer versions prior to 7.6.5, 7.4.8,
                    FortiAnalyzer Cloud versions prior to 7.6.5,
                                      7.4.8, 7.2.12.

====================================================================
https://fortiguard.fortinet.com/psirt/FG-IR-26-177
https://fortiguard.fortinet.com/psirt/FG-IR-26-178
_____________________________________________________________________

arbitrary command execution in fgfmsd daemon


Summary

An improper neutralization of special elements used in an OS command
('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd
daemon may allow a remote attacker impersonating a fortimanager
cluster node to execute unauthorized code or commands via specially
crafted packets. Impersonation of a Fortimanager cluster node requires
possessing the node's certificate and private key.


Version         Affected         Solution

FortiManager 8.0         8.0.0         Upgrade to 8.0.1 or above

FortiManager 7.6         7.6.0 through 7.6.6         Upgrade to 7.6.7
or above

FortiManager 7.4         Not affected         Not Applicable

FortiManager 7.2         Not affected         Not Applicable

FortiManager Cloud 8.0         Not affected         Not Applicable

FortiManager Cloud 7.6         7.6.2 through 7.6.6         Upgrade to 7.6.7
or above

FortiManager Cloud 7.4         Not affected         Not Applicable

FortiManager Cloud 7.2         Not affected         Not Applicable


Virtual Patch
No

Timeline

2026-10-13: Initial publication

_____________________________________________________________________

Multiple Arbitrary File Read/Write via SQL Injection

Summary

An Improper Neutralization of Special Elements used in an SQL Command
('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer,
FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a
low privileged user to execute arbitrary commands via crafted
requests.


Version 	Affected 	Solution

FortiAnalyzer 8.0 	Not affected 	Not Applicable

FortiAnalyzer 7.6 	7.6.0 through 7.6.4 	Upgrade to 7.6.5
or above

FortiAnalyzer 7.4 	7.4.0 through 7.4.7 	Upgrade to 7.4.8
or above

FortiAnalyzer 7.2 	7.2 all versions 	Migrate to a fixed
release

FortiAnalyzer Cloud 7.6 	7.6.2 through 7.6.4 	Upgrade to
7.6.5 or above

FortiAnalyzer Cloud 7.4 	7.4.1 through 7.4.7 	Upgrade to
7.4.8 or above

FortiAnalyzer Cloud 7.2 	7.2.1 through 7.2.11 	Upgrade to
7.2.12 or above

FortiManager 8.0 	Not affected 	Not Applicable

FortiManager 7.6 	7.6.0 through 7.6.4 	Upgrade to 7.6.5
or above

FortiManager 7.4 	7.4.0 through 7.4.6 	Upgrade to 7.4.7
or above

FortiManager 7.2 	7.2 all versions 	Migrate to a
fixed release

FortiManager Cloud 8.0 	Not affected 	Not Applicable

FortiManager Cloud 7.6 	7.6.2 through 7.6.4 	Upgrade to
7.6.5 or above

FortiManager Cloud 7.4 	Not affected 	Not Applicable

FortiManager Cloud 7.2 	Not affected 	Not Applicable


Acknowledgement
Internally reported and discovered by Jaguar Perlas of Burnaby
Infosec team and David Maciejack from Fortinet Product Security
team.


Virtual Patch
No

Timeline

2026-10-13: Initial publication


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================