CVE-2026-22629 An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through…
Description
An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.10, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.10, FortiAnalyzer Cloud 7.0.1 through 7.0.14, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14, FortiManager Cloud 6.4 all versions may allow an attacker to bypass bruteforce protections via exploitation of race conditions. The latter raises the complexity of practical exploitation.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:CExploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiAnalyzer 7.6 | 7.6.0 → 7.6.4 | No fix stated |
| FortiAnalyzer 7.4 | 7.4.0 → 7.4.10 | No fix stated |
| FortiAnalyzer 7.2 | 7.2.0 → 7.2.13 | No fix stated |
| FortiAnalyzer 7.0 | 7.0.0 → 7.0.16 | No fix stated |
| FortiAnalyzer 6.4 | 6.4.0 → 6.4.15 | No fix stated |
| FortiManager Cloud 7.6 | 7.6.2 → 7.6.3 | No fix stated |
| FortiManager Cloud 7.4 | 7.4.1 → 7.4.7 | No fix stated |
| FortiManager Cloud 7.2 | 7.2.1 → 7.2.10 | No fix stated |
| FortiManager Cloud 7.0 | 7.0.1 → 7.0.14 | No fix stated |
Show the 11 other branches Hide the 11 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiManager Cloud 6.4 | 6.4.1 → 6.4.7 | No fix stated |
| FortiAnalyzer Cloud | 7.6.2 | No fix stated |
| FortiAnalyzer Cloud 7.4 | 7.4.1 → 7.4.7 | No fix stated |
| FortiAnalyzer Cloud 7.2 | 7.2.1 → 7.2.10 | No fix stated |
| FortiAnalyzer Cloud 7.0 | 7.0.1 → 7.0.14 | No fix stated |
| FortiAnalyzer Cloud 6.4 | 6.4.1 → 6.4.7 | No fix stated |
| FortiManager 7.6 | 7.6.0 → 7.6.4 | No fix stated |
| FortiManager 7.4 | 7.4.0 → 7.4.10 | No fix stated |
| FortiManager 7.2 | 7.2.0 → 7.2.13 | No fix stated |
| FortiManager 7.0 | 7.0.0 → 7.0.16 | No fix stated |
| FortiManager 6.4 | 6.4.0 → 6.4.15 | No fix stated |