CVE-2025-49784
Published: 10 March 2026
Summary
CVE-2025-49784 is a medium-severity SQL Injection (CWE-89) vulnerability in Fortinet Fortianalyzer. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-49784 is an SQL injection vulnerability (CWE-89) stemming from improper neutralization of special elements in SQL commands. It affects Fortinet FortiAnalyzer versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, and all versions of 7.2, 7.0, and 6.4. The issue also impacts FortiAnalyzer-BigData versions 7.6.0, 7.4.0 through 7.4.4, and all versions of 7.2, 7.0, 6.4, and 6.2. Published on 2026-03-10, the vulnerability carries a CVSS v3.1 base score of 6.0 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L).
An authenticated attacker with high privileges (PR:H) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). By sending specifically crafted requests, the attacker may execute unauthorized code or commands, achieving high confidentiality impact (C:H) alongside low integrity (I:L) and availability (A:L) impacts, with unchanged scope (S:U).
Mitigation details are available in the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-095.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208487
Vulnerability details
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer-BigData 7.6.0, FortiAnalyzer-BigData 7.4.0…
more
through 7.4.4, FortiAnalyzer-BigData 7.2 all versions, FortiAnalyzer-BigData 7.0 all versions, FortiAnalyzer-BigData 6.4 all versions, FortiAnalyzer-BigData 6.2 all versions may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in network-accessible FortiAnalyzer service directly enables remote exploitation of a public-facing application for unauthorized code/command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to reject or neutralize special SQL elements, blocking the crafted requests that trigger CVE-2025-49784.
Mandates timely application of vendor patches that remediate the improper neutralization flaw present in the listed FortiAnalyzer versions.
Limits the high-privilege accounts (PR:H) required for exploitation, reducing the attack surface for authenticated SQL injection attempts.