CVEFinder.io

CVE-2026-25689

🔶 medium
🔍 Scan for this CVE
Summary

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versions, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all versions, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions may allow a privileged attacker with super-admin profile and CLI access to delet

Description

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDeceptor 6.0 all versions, FortiDeceptor 5.3 all versions, FortiDeceptor 5.2 all versions, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions may allow a privileged attacker with super-admin profile and CLI access to delete sensitive files via crafted HTTP requests.

CVSS Score
6.5
Medium
EPSS Score
0.0
Exploit Probability
Published Date
2026-03-10
First Seen: 2026-03-11
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 47.8% of all 321,566 vulnerabilities in our database.

#167,705
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Mar 10, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-03-13
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CWE IDs (Weakness Types)
CWE-88

📦 Affected Products 2

Vendor Product Status Affected Versions
fortinet fortideceptor Affected
> 4.0.0 < 6.0.3
fortinet fortideceptor Affected
v6.2.0

🔗 References 1

https://fortiguard.fortinet.com/psirt/FG-IR-26-094
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-25690 🔶 medium 4.3 0.1 An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDec... 2026-05-12
CVE-2024-35280 🔶 medium 5.4 0.2 A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDe... 2025-01-15
CVE-2024-45326 🔶 medium 4.3 0.1 An Improper Access Control vulnerability [CWE-284] vulnerability in Fortinet FortiDeceptor 6.0.0, FortiDeceptor 5.3 all... 2025-01-14
CVE-2022-27487 ⚠️ high 8.8 1.0 A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2... 2023-04-11
CVE-2023-26209 ℹ️ low 3.7 7.3 A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and ... 2023-03-09
CVE-2022-30305 ℹ️ low 3.7 0.2 An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1... 2022-12-06
These CVEs affect the same products