CVE-2026-23705
HIGH(7.2)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 7.2 — Hoch
Erwähnungen (letzte 60 Tage)
EPSS-Score
0.3%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
7.2
Technische Schwere
Beschreibung
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.13, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.
Erkennung & Indikatoren
Ausnutzung
In den geprüften Quellen nicht genannt
Threat-Hunting-Queries
Sentinel/Defender KQL
DeviceProcessEvents
| where InitiatingProcessCommandLine contains "sql" and ProcessCommandLine contains "cmd.exe" or ProcessCommandLine contains "powershell.exe"
| where InitiatingProcessFileName contains "FortiAnalyzer" or InitiatingProcessFileName contains "FortiManager"Splunk SPL
(sourcetype="fortianalyzer_logs" OR sourcetype="fortimanager_logs") (cmd.exe OR powershell.exe) (sql_command)
| table _time, host, user, commandSigma
title: Fortinet FortiAnalyzer/FortiManager SQLi RCE Attempt
status: experimental
description: Detects potential remote code execution via SQL Injection in Fortinet FortiAnalyzer/FortiManager by monitoring for suspicious process creations.
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- '\FortiAnalyzer.exe'
- '\FortiManager.exe'
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
condition: selection
fields:
- CommandLine
- ParentCommandLine
tags:
- attack.execution
- cve.2026.23705Elastic ES|QL
from process where process.parent.name : ("FortiAnalyzer.exe", "FortiManager.exe") and process.name : ("cmd.exe", "powershell.exe")SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.
Ausgewertete Quellen