Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
Fortinet FortiAnalyzer, FortiManager: Attacker Privilege Escalation via Malformed Input
CVE-2025-68648
Summary
Some versions of Fortinet's FortiAnalyzer and FortiManager software may allow an attacker to gain more access to the system if they send specially crafted requests. This could lead to unauthorized access and potentially harm the system. Update the software to the latest version to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| fortinet | fortianalyzer | > 7.0.0 , <= 7.4.8 | – |
| fortinet | fortianalyzer | > 7.6.0 , <= 7.6.5 | – |
| fortinet | fortianalyzer_cloud | > 7.0.0 , <= 7.4.8 | – |
| fortinet | fortianalyzer_cloud | > 7.6.0 , <= 7.6.5 | – |
| fortinet | fortimanager | > 7.0.0 , <= 7.4.8 | – |
| fortinet | fortimanager | > 7.6.0 , <= 7.6.5 | – |
| fortinet | fortimanager_cloud | > 7.0.0 , <= 7.4.8 | – |
| fortinet | fortimanager_cloud | > 7.6.0 , <= 7.6.5 | – |
Original title
A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all ve...
Original description
A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.7, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.0 through 7.4.7, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions may allow an attacker to escalate its privileges via specially crafted requests.
nvd CVSS3.1
7.2
Vulnerability type
CWE-134
Published: 10 Mar 2026 · Updated: 13 Mar 2026 · First seen: 11 Mar 2026