Improper Access Control in Fortinet FortiManager

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Fortinet, Inc.

Description

An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-22575

Affected Vendors & Products

Vendor	Product	Version / Range
fortinet	fortimanager	From 7.6.0 (inc) to 7.6.4 (inc)
fortinet	fortimanager	From 7.4.0 (inc) to 7.4.10 (inc)
fortinet	fortimanager	7.2
fortinet	fortimanager_cloud	From 7.6.2 (inc) to 7.6.4 (inc)
fortinet	fortimanager_cloud	From 7.4.1 (inc) to 7.4.10 (inc)
fortinet	fortimanager_cloud	7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper access control issue in Fortinet FortiManager versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.10, and all 7.2 versions, as well as FortiManager Cloud versions 7.6.2 through 7.6.4, 7.4.1 through 7.4.10, and all 7.2 versions. It allows an administrator to bypass the approval process for workflow sessions by sending crafted HTTP or HTTPS requests.

Impact Analysis

This vulnerability could allow an administrator to bypass critical workflow approvals, potentially leading to unauthorized changes or actions being taken without proper oversight. This may result in unintended modifications to system configurations or workflows.

Mitigation Strategies

Upgrade FortiManager to a patched version. Fortinet recommends updating to FortiManager 7.6.5 or later, 7.4.11 or later, or 7.2.6 or later. For FortiManager Cloud, update to 7.6.5 or later, or 7.4.11 or later.

Hi! I’m here to help you understand CVE-2026-22575. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70