CVE-2022-29061: Fortinet Fortisoar

High severity, CVSS 7.2. EPSS: 1.6% chance of exploitation in the next 30 days.

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests.

Affected products

• Fortinet Fortisoar: from 6.4.1, up to and including 6.4.4; from 7.0.0, before 7.0.3 (fixed in 7.0.3); version 7.2.0 only

Published 2022-09-09. Last modified 2026-06-17.