{"id":"CVE-2023-26210","aliases":["EUVD-2023-30035","GHSA-mhr4-7gpq-rjpw"],"status":"published","title":"Multiple improper neutralization of special elements used in an os command ('OS Command Injection...","description":"Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet  allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:X/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00478,"percentile":0.41585,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2023-06-13T08:41:46Z","modified":"2026-06-17T05:42:49Z","products":[{"vendor":"fortinet","product":"fortiadc"},{"vendor":"fortinet","product":"fortiadc_manager"},{"vendor":"fortinet","product":"fortiadcmanager"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-076","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26210"},{"url":"https://github.com/advisories/GHSA-mhr4-7gpq-rjpw"}],"sources":{"cve":[{"id":"CVE-2023-26210","description":"Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet  allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests.","status":"published","published":"2023-06-13T08:41:46.873Z","modified":"2026-01-14T14:15:28.898Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:X/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:15.066338Z"}],"euvd":[{"id":"EUVD-2023-30035","description":"Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet  allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests.","status":"published","published":"2023-06-13T08:41:46Z","modified":"2026-01-14T14:15:28Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:X/RC:C","level":"high"}],"updated_at":"2026-11-02T19:48:52.227329Z"}],"ghsa":[{"id":"GHSA-mhr4-7gpq-rjpw","title":"Multiple improper neutralization of special elements used in an os command ('OS Command Injection...","description":"Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] in Fortinet FortiADCManager version 7.1.0 and before 7.0.0, FortiADC version 7.2.0 and before 7.1.2 allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests.","status":"published","published":"2023-06-13T09:30:19Z","modified":"2024-04-04T04:45:40Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:56:26.754135Z"}],"nvd":[{"id":"CVE-2023-26210","description":"Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet  allows a local authenticated attacker to execute arbitrary shell code as `root` user via crafted CLI requests.","status":"published","published":"2023-06-13T09:15:16.51Z","modified":"2026-06-17T05:42:49.84Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:08:06.335469Z"}]}}