CVE-2026-25690
An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.
Severity
Medium 4
CVSS 3.1
Exploited
Not listed
EPSS
0.002
15.2th percentile
Discovered by
Not disclosed
Published
May 12, 2026
Assigned by fortinet
Description
An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.0 through 5.2.1, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests.
Weakness: CWE-88
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiDeceptor | Threat Detection & Sandbox | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiDeceptor
Vendor remediation
Upgrade to upcoming FortiDeceptor version 6.3.0 or above Upgrade to FortiDeceptor version 6.1.0 or above