PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25088 Fortinet CVE debrief

Fortinet disclosed a SQL injection vulnerability (CWE-89) in its FortiNDR network detection and response platform on 12 May 2026, with subsequent modification on 18 May 2026. The flaw affects multiple FortiNDR release trains: versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.9, and all versions of 7.2, 7.1, and 7.0. An authenticated attacker can exploit this weakness via specially crafted HTTP requests to execute unauthorized code or commands. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) yields a base score of 5.4 (Medium severity), reflecting network attackability with low attack complexity and privileges required, but no availability impact. Fortinet has published remediation guidance through its PSIRT advisory.

Vendor
Fortinet
Product
FortiNDR
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-18
Advisory published
2026-05-12
Advisory updated
2026-05-18

Who should care

Organizations operating FortiNDR for network threat detection and response, particularly those with externally accessible management interfaces or multiple administrative users. Security teams should prioritize patching during standard maintenance windows given the authenticated nature of the attack vector.

Technical summary

This vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89) within FortiNDR's HTTP request handling. The affected codebase fails to adequately sanitize user-supplied input before incorporating it into database queries. Successful exploitation requires valid authentication credentials, limiting exposure to insider threats or compromised accounts. The attack vector is network-based with low complexity, suggesting automated exploitation is feasible given credential access. Impact is constrained to confidentiality and integrity (low severity each) with no direct availability impact per CVSS scoring.

Defensive priority

medium

Recommended defensive actions

  • Upgrade FortiNDR to patched versions 7.4.10 or 7.6.3 or later
  • Review and restrict administrative access to FortiNDR management interfaces
  • Monitor HTTP request logs for anomalous patterns indicative of SQL injection attempts
  • Apply principle of least privilege for FortiNDR authentication accounts
  • Validate input sanitization on any custom integrations with FortiNDR APIs

Evidence notes

The vulnerability is classified as CWE-89 (SQL Injection) per Fortinet's advisory. CPE criteria confirm affected versions span 7.0.x through 7.4.9 and 7.6.0-7.6.2, with fixes available in 7.4.10 and 7.6.3. The CVSS 3.1 score of 5.4 indicates limited confidentiality and integrity impact under authenticated conditions.

Official resources

Fortinet disclosed this vulnerability via its PSIRT advisory on 12 May 2026. The NVD entry was subsequently modified on 18 May 2026, likely reflecting analysis completion or reference updates. No CISA KEV listing exists as of the disclosure