CVE-2026-22572: 
Fortinet FortiManager vulnerability analysis and mitigation

CVE-2026-22572 is an authentication bypass vulnerability (CWE-288: Authentication Bypass Using an Alternate Path or Channel) in Fortinet FortiAnalyzer and FortiManager that allows an attacker with knowledge of an administrator's password to bypass multifactor authentication (MFA) checks by submitting multiple crafted requests. Affected products include FortiAnalyzer 7.2.2–7.2.11, 7.4.0–7.4.7, and 7.6.0–7.6.3; FortiManager 7.2.2–7.2.11, 7.4.0–7.4.7, and 7.6.0–7.6.3; and FortiManager Cloud/FortiAnalyzer Cloud across the same version ranges. The vulnerability was disclosed on March 10, 2026, and was discovered during an internal product security audit commissioned by Fortinet. It carries a CVSSv3.1 base score of 6.8 (Medium) per the vendor advisory, though NVD rates it at 7.2 (High) (Fortinet PSIRT, Feedly).

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and resides in the GUI component of FortiManager and FortiAnalyzer's MFA implementation. An attacker who already possesses a valid administrator password can submit multiple specially crafted authentication requests to circumvent the MFA verification step, effectively gaining access without completing the second factor. Exploitation requires network access and prior knowledge of administrator credentials (high privilege precondition), but no user interaction is needed. No public proof-of-concept code has been identified (Fortinet PSIRT).

Successful exploitation grants an attacker unauthorized administrative access to FortiAnalyzer or FortiManager deployments, bypassing the MFA control that serves as a critical second layer of defense. This could allow manipulation of security configurations, access to sensitive log and analytics data, compromise of managed network device configurations, and potential disruption of security monitoring infrastructure. The confidentiality, integrity, and availability of managed security infrastructure are all at risk (Fortinet PSIRT, Feedly).

1. Credential Acquisition: Obtain a valid FortiAnalyzer or FortiManager administrator account password through phishing, credential stuffing, or prior compromise.
2. Identify Target: Locate an internet-facing or network-accessible FortiAnalyzer/FortiManager GUI running an affected version (7.2.2–7.2.11, 7.4.0–7.4.7, or 7.6.0–7.6.3).
3. Initiate Authentication: Begin the login process using the known administrator credentials via the web GUI, triggering the MFA challenge.
4. Submit Crafted Requests: Send multiple specially crafted authentication requests in rapid succession or in a specific sequence to the GUI authentication endpoint, exploiting the alternate path/channel flaw to bypass the MFA verification step.
5. Gain Administrative Access: Successfully authenticate as the administrator without completing the MFA challenge, obtaining full administrative control over the FortiAnalyzer or FortiManager instance (Fortinet PSIRT).

• Logs: Authentication logs showing successful admin logins without a corresponding completed MFA event; multiple rapid authentication requests from the same source IP within a short timeframe targeting the GUI login endpoint.
• Network: Unusual volume of authentication requests to the FortiAnalyzer/FortiManager GUI from a single IP; administrative sessions originating from unexpected or untrusted IP addresses.
• Behavioral: Administrative configuration changes made outside of normal business hours or by accounts not expected to be active; new administrator accounts created or existing accounts modified shortly after suspicious login activity (Fortinet PSIRT).

Fortinet has released patched versions addressing this vulnerability. Users should upgrade to the following fixed releases: FortiAnalyzer 7.6.4 or above, FortiAnalyzer 7.4.8 or above (FortiAnalyzer 7.2.x users should migrate to a fixed release); FortiManager 7.6.4 or above, FortiManager 7.4.8 or above (FortiManager 7.2.x users should migrate to a fixed release); FortiManager Cloud 7.2.11 or above, 7.4.8 or above, or 7.6.4 or above. As interim measures, restrict administrative GUI access to trusted networks only using firewall rules, enforce strong unique administrator passwords, monitor authentication logs for anomalous MFA bypass patterns, and disable unused administrator accounts (Fortinet PSIRT).

Coverage of CVE-2026-22572 has been limited to security news aggregators and vulnerability tracking platforms, with no notable independent researcher commentary or significant social media discussion identified. Security news outlets such as CyberSecurityNews and TheDailyTechFeed covered it as part of broader Fortinet March 2026 patch roundups. The vulnerability was discovered internally by Fortinet through a commissioned product security audit, which the vendor disclosed proactively (Fortinet PSIRT).