The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.15, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Fortinet Fortiproxy | — | Upgrade to the latest version of FortiProxyUpgrade FortiProxy to 7.0.16Upgrade FortiProxy to 7.4.3Upgrade FortiProxy to 7.2.9 | Sep 30, 2026 | Aug 12, 2025 |
| Fortinet Fortiswitchmanager | — | Upgrade FortiSwitchManager to 7.2.4Upgrade to the latest version of FortiSwitchManagerUpgrade FortiSwitchManager to 7.0.4 | Sep 30, 2026 | Aug 12, 2025 |
| Fortios | — | Upgrade FortiOS to 6.2.17Upgrade FortiOS to 6.4.16Upgrade to the latest version of FortiOS | Aug 15, 2025 | Aug 12, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub