CVE-2025-61848 Fortinet CVE debrief

Who should care

Organizations using Fortinet FortiAnalyzer and FortiManager products, especially those with privileged authenticated access to the JSON RPC API, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing affected product deployments, applying patches, and monitoring for suspicious activity. Security teams and vulnerability management teams should prioritize patching vulnerable versions to prevent potential SQL injection attacks.

Technical summary

A SQL injection vulnerability exists in Fortinet FortiAnalyzer and FortiManager products, allowing a privileged authenticated attacker to execute unauthorized code or commands via JSON RPC API. The vulnerability affects various versions of FortiAnalyzer and FortiManager, including 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, and all versions of 7.2 and 7.0. This vulnerability can be exploited through JSON RPC API, potentially leading to code execution.

Defensive priority

Organizations using Fortinet FortiAnalyzer and FortiManager products should prioritize patching vulnerable versions to prevent potential SQL injection attacks.

Recommended defensive actions

• Apply patches for vulnerable Fortinet FortiAnalyzer and FortiManager products
• Restrict access to JSON RPC API
• Monitor for suspicious activity
• Inventory affected products
• Implement compensating controls

Evidence notes

The CVE record indicates a SQL injection vulnerability in Fortinet FortiAnalyzer and FortiManager products. A privileged authenticated attacker may execute unauthorized code or commands via JSON RPC API. The vulnerability has a CVSS score of 7.2 and is classified as HIGH. Evidence is limited to CVE and NVD details. Defenders should verify affected product deployments, review official advisories, and monitor for suspicious activity.

Official resources