CVE-2026-25088: Fortinet FortiNDR SQL Injection Vulnerability

CVE-2026-25088 Overview

CVE-2026-25088 is a SQL injection vulnerability affecting Fortinet FortiNDR. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. An authenticated attacker can send specifically crafted HTTP requests to execute unauthorized code or commands on the appliance.

The vulnerability impacts FortiNDR versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.9, and all versions of the 7.2, 7.1, and 7.0 branches. Fortinet tracks this issue under advisory FG-IR-26-134.

Critical Impact

Authenticated attackers can manipulate backend SQL queries to execute unauthorized commands against FortiNDR appliances responsible for network detection and response.

Affected Products

• Fortinet FortiNDR 7.6.0 through 7.6.2
• Fortinet FortiNDR 7.4.0 through 7.4.9
• Fortinet FortiNDR 7.2, 7.1, and 7.0 (all versions)

Discovery Timeline

• 2026-05-12 - CVE CVE-2026-25088 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-25088

Vulnerability Analysis

FortiNDR is Fortinet's Network Detection and Response appliance, which inspects network traffic and surfaces anomalous behavior. The product exposes a management interface that accepts HTTP requests from authenticated operators. CVE-2026-25088 exists because one or more of those request handlers concatenate user-supplied parameters directly into SQL statements without proper sanitization or parameterized query usage.

An attacker holding valid credentials can submit crafted HTTP parameters that break out of the intended query context. The injected SQL then runs with the privileges of the database backend, which on appliance-class products typically maps to elevated internal roles. According to the Fortinet advisory, this enables execution of unauthorized code or commands on the device.

The scope is constrained because exploitation requires prior authentication, and the assigned CVSS impact limits both confidentiality and integrity to a partial level with no direct availability impact. The vulnerability is classified under [CWE-89]: Improper Neutralization of Special Elements used in an SQL Command.

Root Cause

The root cause is missing input neutralization in HTTP request handlers that build SQL statements. Affected code paths trust authenticated input and pass attacker-controlled values into query strings rather than binding them as parameters. This permits attackers to inject SQL syntax, modify query semantics, and pivot from data access to command execution.

Attack Vector

The attack vector is network-based and requires low-privileged authenticated access to the FortiNDR management interface. An attacker constructs an HTTP request containing SQL metacharacters in a vulnerable parameter, submits it to the affected endpoint, and observes the result through the application response or out-of-band channels. No user interaction is required.

No verified public proof-of-concept is currently available. The vulnerability mechanism is described in the Fortinet Security Advisory FG-IR-26-134.

Detection Methods for CVE-2026-25088

Indicators of Compromise

• HTTP requests to FortiNDR management endpoints containing SQL metacharacters such as single quotes, UNION, SELECT, --, or stacked semicolons in parameter values.
• Authenticated administrative sessions originating from unexpected IP ranges or service accounts that do not normally interact with the appliance.
• Database error strings or unusually long response times returned by FortiNDR web endpoints following crafted requests.

Detection Strategies

• Enable verbose HTTP access logging on FortiNDR and forward logs to a centralized SIEM for inspection of request bodies and query strings.
• Build detection rules that match SQL injection patterns against management URIs, focusing on parameters bound to user-supplied identifiers or filters.
• Correlate authentication events with subsequent administrative actions to identify low-privileged accounts performing unexpected queries.

Monitoring Recommendations

• Monitor FortiNDR audit logs for anomalous command execution or configuration changes following web sessions.
• Track failed and successful logins to the management interface and alert on credential use outside business hours.
• Restrict and monitor egress traffic from the FortiNDR appliance to detect command-and-control or data staging attempts that may follow successful exploitation.

How to Mitigate CVE-2026-25088

Immediate Actions Required

• Identify all FortiNDR appliances in the environment and confirm their firmware version against the affected ranges listed in FG-IR-26-134.
• Restrict access to the FortiNDR management interface to a dedicated administrative network or jump host.
• Rotate credentials for any account capable of authenticating to FortiNDR, and remove unused or shared administrative accounts.

Patch Information

Fortinet has published remediation guidance in advisory FG-IR-26-134. Administrators should upgrade FortiNDR to a fixed release outside the affected version ranges. Branches 7.2, 7.1, and 7.0 are listed as affected in all versions, and operators on those branches should consult the advisory for upgrade paths to a supported fixed release.

Workarounds

• Limit management interface exposure to trusted source IP addresses using trusthost configuration or upstream network ACLs.
• Enforce multi-factor authentication for all FortiNDR administrative accounts to raise the bar for credentialed exploitation.
• Apply least-privilege role assignments so that operator accounts cannot reach the vulnerable endpoints unless required.

# Example: restrict FortiNDR admin access to a trusted management subnet
config system admin
  edit "admin"
    set trusthost1 10.10.20.0 255.255.255.0
  next
end