CVE-2026-22628

An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute system commands via a specifically crafted SSH config file.

Severity
Medium 5.1
CVSS 3.1
Exploited
Not listed
EPSS
0.001
4.3th percentile
Discovered by
Vendor
Vendor advisory field
Published
Mar 10, 2026
Assigned by fortinet

Description

An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute system commands via a specifically crafted SSH config file.

Weakness: CWE-284

Affected products

Vendor Product Category Matched by
Fortinet FortiSwitch Routing & Switching cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiSwitchAXFixed

Credit

Internally discovered and reported by Yonghui Han of Fortinet Product Security team.

Vendor remediation

Upgrade to FortiSwitchAX-Chassis version 1.0.0 or above Upgrade to FortiSwitchAXFixed version 1.0.2 or above

Something wrong here?