Jump to the main content block
  1. Home
  2. Information Security
  3. Vulnerability Alert

【Vulnerability Alert】FortiAnalyzer, FortiManager, FortiManager Cloud, and FortiAnalyzer Cloud Have a Critical Security Vulnerability (CVE-2025-46773)

publish date : 2026-10-22 update date : 2026-10-22

Source: Ministry of education information & communication security contingency platform

Publication Number TACERT-ANA-2026101510102121 Publication Time 2026-10-15 10:57:23
Incident Type ANA-Vulnerability Alert Discovery Time 2026-10-15 10:57:23
Impact Level Low  
[Subject]
【Vulnerability Alert】FortiAnalyzer, FortiManager, FortiManager Cloud, and FortiAnalyzer Cloud Have a Critical Security Vulnerability (CVE-2025-46773)
[Content]
Forwarded from TWCERTCC-200-202610-00000018

Fortinet has issued an advisory regarding a critical security vulnerability in FortiAnalyzer, FortiManager, FortiManager Cloud, and FortiAnalyzer Cloud (CVE-2025-46773, CVSS: 8.8). This is an SQL injection vulnerability caused by improper handling of special elements, which may allow a low-privileged user to execute arbitrary commands through specially crafted requests.

Information Sharing Level: WHITE (Information content can be publicly disclosed)
[Affected Platform]
FortiAnalyzer versions 7.6.0 through 7.6.4, FortiAnalyzer versions 7.4.0 through 7.4.7, FortiAnalyzer version 7.2, FortiAnalyzer Cloud versions 7.62 through 7.6.4, FortiAnalyzer Cloud versions 7.4.1 through 7.4.7, FortiAnalyzer Cloud versions 7.2.1 through 7.2.11, FortiManager versions 7.6.0 through 7.6.4, FortiManager versions 7.4.0 through 7.4.6, FortiManager version 7.2, FortiManager Cloud versions 7.6.2 through 7.6.4
[Recommended Actions]
Please update to the following versions: FortiAnalyzer version 7.6.5, FortiAnalyzer version 7.4.8, FortiAnalyzer Cloud version 7.6.5, FortiAnalyzer Cloud version 7.4.8, FortiAnalyzer Cloud version 7.2.12, FortiManager version 7.6.5, FortiManager version 7.4.7, FortiManager Cloud version 7.6.5
[Reference]
1. https://www.twcert.org.tw/tw/cp-169-11282-d479f-1.html
(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw
Organizer: Computer Center
Click Num:
Print