Description
An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.15, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiProxy | 7.4.0 – ≤ 7.4.2, 7.2.0 – ≤ 7.2.8, 7.0.0 – ≤ 7.0.15 | — |
| Fortinet | FortiOS | 6.4.0 – ≤ 6.4.15, 6.2.0 – ≤ 6.2.16, 6.0.0 – ≤ 6.0.18 | — |
| Fortinet | FortiPAM | 1.2.0, 1.1.0 – ≤ 1.1.2, 1.0.0 – ≤ 1.0.3 | — |
| Fortinet | FortiSwitchManager | 7.2.0 – ≤ 7.2.3, 7.0.0 – ≤ 7.0.3 | — |
Advisories 4
- ICSA-24-074-11 Siemens RUGGEDCOM APE1808 with Fortigate NGFW Devices CISA ICS & IT advisories · Jan 14, 2026
- SSA-366067 SSA-366067: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Jan 13, 2026
- NCSC-2025-0255 Kwetsbaarheden verholpen in Fortinet producten NCSC-NL (Netherlands) · Aug 13, 2025
- WID-SEC-2025-1804 Fortinet FortiOS und FortiProxy: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Aug 12, 2025