CVE-2026-25690 MEDIUM

CVE-2026-25690

Vendor Fortinet
Product FortiDeceptor
Weakness CWE-88
Published May 12, 2026
Last update May 12, 2026

CVSS base score

4.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C

What the vulnerability does

01Description

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0 through 5.3.3, FortiDeceptor 5.2.0 through 5.2.1, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions may allow an authenticated attacker with at least read-only admin permission to read log files via HTTP crafted requests.

Key dates

02Disclosure timeline

May 12, 2026 CVE published
May 12, 2026 Record updated