CVE-2025-31104
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 through 7.1.4, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated attacker to execute unauthorized code via crafted HTTP requests.
Scoring
- Severity
- HIGH
- CVSS base score
- 7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
- EPSS probability
- 1.07%
- CWE
- CWE-78
- Published
- 2025-06-10
- Last modified
- 2026-08-31
Affected products
- Fortinet FortiADC
- Fortinet FortiADC
- Fortinet FortiADC
- Fortinet FortiADC
- Fortinet FortiADC
- Fortinet FortiADC
- Fortinet FortiADC
- Fortinet FortiADC
Weakness type
Related vulnerabilities
- CVE-2026-83549 — Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi
- CVE-2026-86152 — Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection
- CVE-2026-82004 — Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- CVE-2026-79724 — Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- CVE-2026-90822 — FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command i
- CVE-2026-81467 — Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS C
- CVE-2026-71376 — OS Command Injection Vulnerability in Cosminexus Component Container
- CVE-2026-57124 — PraisonAI UI MCP connect endpoint allows unauthenticated local command execution