CyberCVE

CVE-2026-22575

An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiMa

Severity
Medium 4.7
CVSS 3.1
Exploited
Not listed
EPSS
0.002
16.0th percentile
Discovered by
Third party
Vendor advisory acknowledgement
Published
Sep 8, 2026
Assigned by fortinet

Description

An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests.

Weakness: CWE-284

Affected products

Vendor Product Category Matched by
Fortinet FortiManager Network & Security Management cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiManager
  • Fortinet · FortiManager Cloud

Credit

Fortinet is pleased to thank Martin Cechvala for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiManager version 8.0.0 or above Upgrade to FortiManager version 7.6.5 or above Upgrade to FortiManager version 7.4.11 or above Upgrade to upcoming FortiManager Cloud version 8.0.0 or above Upgrade to FortiManager Cloud version 7.6.5 or above Upgrade to upcoming FortiManager Cloud version 7.4.11 or above

References

Something wrong here?