---
id: CVE-2026-25690
title: >-
  An improper neutralization of argument delimiters in a command ('argument
  injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2,
  FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.0 through 5.2.1,
  FortiDeceptor 5.1 al…
summary: >-
  An improper neutralization of argument delimiters in a command ('argument
  injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2,
  FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.0 through 5.2.1,
  FortiDeceptor 5.1 al…
severity: medium
cvss: 4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-88
vendor: Fortinet
product: FortiDeceptor
affected:
  - FortiDeceptor >= 6.0.0 <= 6.0.2
  - FortiDeceptor >= 5.3.0 <= 5.3.3
  - FortiDeceptor >= 5.2.0 <= 5.2.1
  - FortiDeceptor 5.1.0
  - FortiDeceptor 5.0.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-12T19:00:14.405140Z'
published: '2026-05-12'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:11.985Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-25690'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-138'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-138'
tags:
  - cve.org
epss: 0.00241
epssPercentile: 0.15269
ingestedAt: '2026-11-06T15:54:03.975Z'
---

## Overview

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.0 through 5.2.1, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests.

## Affected

- `FortiDeceptor >= 6.0.0 <= 6.0.2`
- `FortiDeceptor >= 5.3.0 <= 5.3.3`
- `FortiDeceptor >= 5.2.0 <= 5.2.1`
- `FortiDeceptor 5.1.0`
- `FortiDeceptor 5.0.0`

## Remediation

Upgrade to FortiDeceptor version 6.3.0 or above
Upgrade to FortiDeceptor version 6.1.0 or above