Description
A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiOS | 7.6.0 – ≤ 7.6.1, 7.4.0 – ≤ 7.4.5, 7.2.0 – ≤ 7.2.10, 7.0.1 – ≤ 7.0.16 | — |
| Fortinet | FortiProxy | 7.6.0 – ≤ 7.6.1, 7.4.0 – ≤ 7.4.8, 7.2.0 – ≤ 7.2.13, 7.0.0 – ≤ 7.0.20 | — |
Advisories 3
- ICSA-25-044-06 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · Mar 12, 2026
- SSA-770770 SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Mar 10, 2026
- WID-SEC-2025-1486 Fortinet FortiOS / FortiProxy: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 8, 2025