Fortinet patches four SQL injection flaws in FortiAnalyzer and FortiManager

Fortinet published advisories on 13 October 2026 for four SQL injection bugs (CWE-89) in FortiAnalyzer and FortiManager: CVE-2026-23705 and CVE-2026-23707 rated 7.2, CVE-2026-23706 at 6.5 and CVE-2025-46773 at 8.8. Branches 7.2 through 7.6 and cloud variants are affected, and a low-privileged user may execute arbitrary commands.

• CVE-2025-46773 carries the highest score of the four at 8.8
• FortiAnalyzer and FortiManager branches 7.2 through 7.6 and cloud variants are affected
• A path traversal CVE-2026-106173 in FortiSIEM 7.5.0 rated 9.8 was published in the same window
• Exploitation requires an authenticated account, not necessarily an admin one