Introduction
An SQL injection vulnerability in the FortiDDoS-F REST API lets authenticated attackers execute arbitrary SQL commands against the appliance's backend database. Organizations use FortiDDoS-F to protect against volumetric and application-layer DDoS attacks, and this flaw undermines the integrity of the device that defends their network perimeter.
FortiDDoS-F is Fortinet's dedicated DDoS mitigation appliance. It detects and blocks DDoS attacks at the network edge with behavioral analysis rather than signature-based detection. Enterprises and service providers deploy it to protect critical infrastructure, and its REST API is the primary programmatic management interface for configuration, monitoring, and automation workflows.
Technical Information
The root cause of CVE-2026-39815 is improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL Injection). The vulnerable component is the REST API of the FortiDDoS-F appliance.
Administrators use the FortiDDoS REST API to configure settings, gather statistics, and manage the appliance with standard HTTP methods. The API uses JSON for settings data and XML for traffic graph information, and it authenticates requests with bearer tokens. Among other things, it can modify service protection profiles, retrieve system statistics, and download backup configuration files.
The API does not properly sanitize or parameterize user-supplied input before it builds SQL queries with that input. When an authenticated user sends a crafted HTTP request containing malicious SQL fragments, those fragments reach the database engine without adequate neutralization.
Attack Flow
Exploitation follows four steps:
-
The attacker must first obtain valid credentials and authenticate to the FortiDDoS-F system. Because the REST API uses bearer token authentication, the attacker needs a valid token, which comes from the standard API login flow.
-
With that token, the attacker builds an HTTP request to the REST API that embeds SQL injection payloads in request parameters or body fields. Fortinet has not publicly disclosed which API endpoint or parameter is vulnerable.
-
The API does not neutralize special characters in the input (such as single quotes, semicolons, or SQL keywords), so the injected SQL is concatenated into the query string and the database engine executes it.
-
If exploitation succeeds, the attacker can run arbitrary SQL queries. Given how much of the appliance the API controls, this could result in exfiltration of sensitive configuration data, modification of protection profiles, or broader compromise of the appliance's operational integrity.
FortiGuard Labs assigns a CVSS score of 7.9 (High), while the NVD lists a score of 8.8. Requiring prior authentication is a meaningful barrier to exploitation, but it does not remove the risk. Credential theft, insider threats, or compromised service accounts with API access could all provide the necessary foothold.
Affected Systems and Versions
The following versions of FortiDDoS-F are affected:
| Product | Vulnerable Versions | Fixed Version |
|---|---|---|
| FortiDDoS-F | 7.2.1 through 7.2.2 | 7.2.3 or above |
These FortiDDoS-F versions are explicitly not affected:
- FortiDDoS-F 7.0 (all releases)
- FortiDDoS-F 6.6 (all releases)
- FortiDDoS-F 6.5 (all releases)
- FortiDDoS-F 6.4 (all releases)
- FortiDDoS-F 6.3 (all releases)
Only systems where the REST API is enabled and accessible are exposed to this vulnerability. Environments that have disabled API access, or restricted it to trusted management networks, have a reduced attack surface.
Vendor Security History
Fortinet's perimeter security products have a well-documented history of critical vulnerabilities that threat actors have exploited widely:
-
CVE-2018-13379: A path traversal vulnerability in Fortinet SSL VPNs. Multiple threat actors, including the LockBit ransomware group, exploited it routinely across several years, and it appeared in CISA's 2022 list of top routinely exploited vulnerabilities.
-
CVE-2022-40684: An authentication bypass vulnerability in FortiOS and FortiProxy. CISA added it to the Known Exploited Vulnerabilities catalog, and affected organizations had to mitigate it urgently.
Sophisticated threat actors consistently target Fortinet appliances, particularly those exposed at the network perimeter. Any vulnerability management program should treat patches for Fortinet products as high priority.
References
- FortiGuard PSIRT Advisory FG-IR-26-119
- FortiDDoS-F 7.0.3 Handbook
- FortiDDoS REST API Reference
- CISA: 2022 Top Routinely Exploited Vulnerabilities
- CISA: Understanding LockBit
- Fortinet Blog: Update Regarding CVE-2022-40684
- CISA Known Exploited Vulnerabilities Catalog (Fortinet)
- Fortinet Q4 2025 Financial Results
