Skip to content
Sign in
6.8 Medium

CVE-2026-22572 An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3,…

Description

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.2 through 7.2.12, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.2 through 7.2.12 may allow an attacker with knowledge of the admins password to bypass multifactor authentication checks via submitting multiple crafted requests.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

Exploitable remotely over the network, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Privileges required
High
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected products and versions

Product Affected versions Fixed in
FortiManager 7.6 7.6.0 → 7.6.3 No fix stated
FortiManager 7.4 7.4.0 → 7.4.7 No fix stated
FortiManager 7.2 7.2.2 → 7.2.13 No fix stated
FortiAnalyzer 7.6 7.6.0 → 7.6.3 No fix stated
FortiAnalyzer 7.4 7.4.0 → 7.4.7 No fix stated
FortiAnalyzer 7.2 7.2.2 → 7.2.13 No fix stated

Other CVEs of FortiManager

The 88 CVEs of FortiManager →
CVE-2026-23705 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]… 6.5 Medium CVE-2026-23707 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]… 6.5 Medium CVE-2026-23706 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]… 5.9 Medium CVE-2026-106171 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet… 5.3 Medium
Track this CVE