Vulnerability · Published Mar 10, 2026 · Assigned by fortinet
CVE-2026-22572
Medium 6.8
In plain English
A medium-severity authentication bypass in FortiAnalyzer from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.2 through 7.2.11, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.2 through 7.2.11 may allow an attacker with knowledge of the admins password to bypass multifactor authentication checks via submitting multiple crafted requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiManager | 7.6.0 – through 7.6.37.4.0 – through 7.4.77.2.2 – through 7.2.12 |
| Fortinet | FortiAnalyzer | 7.6.0 – through 7.6.37.4.0 – through 7.4.77.2.2 – through 7.2.12 |
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C