Back www.fortiguard.com

FortiDDoS-F 7.2.1 and 7.2.2, authenticated attackers

www.fortiguard.com • April 15, 2026

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiDDoS-F may allow an authenticated attacker to run arbitrary SQL queries on the database by sending crafted HTTP requests.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SQL Injection Vulnerabilities in FortiClient EMS and FortiDDoS-F Two SQL injection vulnerabilities have been identified in Fortinet products: FortiClient EMS and FortiDDoS-F. The vulnerability in FortiClient EMS allows authenticated attackers to execute arbitrary SQL queries on the database via crafted requests. Fortinet has remediated this issue in FortiClient Cloud and FortiSASE, requiring no action from customers. Similarly, the vulnerability in FortiDDoS-F also permits authenticated attackers to run arbitrary SQL queries through crafted HTTP requests. The affected versions of FortiDDoS-F are 7.2.1 and 7.2.2. Customers using these versions should be aware of the potential risks. No specific CVEs were mentioned for these vulnerabilities in the articles. The current status indicates that remediation has been implemented for FortiClient EMS, while FortiDDoS-F remains vulnerable without a patch mentioned. 52

Extracted Entities

FortiDDoS-F 7.2.1 and 7.2.2, authenticated attackers

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)