An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Fortinet Fortianalyzer | — | Upgrade FortiAnalyzer to 7.4.10Upgrade FortiAnalyzer to 7.0.16Upgrade FortiAnalyzer to 7.6.6Upgrade FortiAnalyzer to 7.2.12 | Feb 2, 2026 | Jan 27, 2026 |
| Fortinet Fortimanager | — | Upgrade FortiManager to 7.6.6Upgrade FortiManager to 7.4.10Upgrade FortiManager to 7.0.16Upgrade FortiManager to 7.2.12 | Feb 2, 2026 | Jan 27, 2026 |
| Fortinet Fortiproxy | — | Upgrade FortiProxy to 7.2.16Upgrade to the latest version of FortiProxyUpgrade FortiProxy to 7.6.5Upgrade FortiProxy to 7.0.23Upgrade FortiProxy to 7.4.13 | Sep 30, 2026 | Jan 27, 2026 |
| Fortinet Fortiswitchmanager | — | Upgrade FortiSwitchManager to 7.0.8Upgrade to the latest version of FortiSwitchManagerUpgrade FortiSwitchManager to 7.2.9 | Sep 30, 2026 | Jan 27, 2026 |
| Fortinet Fortiweb | — | Upgrade FortiWeb to 7.4.12Upgrade FortiWeb to 8.0.4Upgrade FortiWeb to 7.6.7 | Jun 30, 2026 | Jan 27, 2026 |
| Fortios | — | Upgrade FortiOS to 7.6.6Upgrade FortiOS to 7.2.13Upgrade FortiOS to 7.4.11Upgrade FortiOS to 7.0.19 | Feb 2, 2026 | Jan 27, 2026 |
| Fortiproxy | — | Upgrade to the latest version of Fortinet FortiProxy | Feb 2, 2026 | Jan 27, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub