Description
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.2 through 7.2.12, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.2 through 7.2.12 may allow an attacker with knowledge of the admins password to bypass multifactor authentication checks via submitting multiple crafted requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiAnalyzer | 7.6.0 – ≤ 7.6.3, 7.4.0 – ≤ 7.4.7, 7.2.2 – ≤ 7.2.13 | — |
| Fortinet | FortiManager | 7.6.0 – ≤ 7.6.3, 7.4.0 – ≤ 7.4.7, 7.2.2 – ≤ 7.2.13 | — |
Advisories 2
- NCSC-2026-0086 Kwetsbaarheden verholpen in Fortinet FortiManager en FortiAnalyzer NCSC-NL (Netherlands) · Mar 11, 2026
- WID-SEC-2026-0671 Fortinet FortiAnalyzer und FortiManager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 10, 2026