---
id: CVE-2026-25088
title: >-
  An improper neutralization of special elements used in an sql command ('sql
  injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR
  7.4.0 through 7.4.9, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions,
  FortiNDR …
summary: >-
  An improper neutralization of special elements used in an sql command ('sql
  injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR
  7.4.0 through 7.4.9, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions,
  FortiNDR …
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:X'
cvssSource: cna
cwe:
  - CWE-89
vendor: Fortinet
product: FortiNDR
affected:
  - FortiNDR >= 7.6.0 <= 7.6.2
  - FortiNDR >= 7.4.0 <= 7.4.9
  - FortiNDR >= 7.2.0 <= 7.2.5
  - FortiNDR >= 7.1.0 <= 7.1.1
  - FortiNDR >= 7.0.0 <= 7.0.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-12T18:59:39.373512Z'
published: '2026-05-12'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:11.038Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-25088'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-134'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-134'
tags:
  - cve.org
epss: 0.00264
epssPercentile: 0.18392
ingestedAt: '2026-11-06T15:54:03.981Z'
---

## Overview

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through 7.4.9, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via  specifically crafted HTTP requests.

## Affected

- `FortiNDR >= 7.6.0 <= 7.6.2`
- `FortiNDR >= 7.4.0 <= 7.4.9`
- `FortiNDR >= 7.2.0 <= 7.2.5`
- `FortiNDR >= 7.1.0 <= 7.1.1`
- `FortiNDR >= 7.0.0 <= 7.0.7`

## Remediation

Upgrade to FortiNDR version 7.6.3 or above
Upgrade to FortiNDR version 7.4.10 or above