CVE-2026-22575: 
Fortinet FortiManager vulnerability analysis and mitigation

CVE-2026-22575 is an improper access control vulnerability in Fortinet FortiManager and FortiManager Cloud that may allow an authenticated administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPS requests. It affects FortiManager versions 6.4.0–6.4.15, 7.0.0–7.0.16, 7.2.0–7.2.12, 7.4.0–7.4.10, and 7.6.0–7.6.4, as well as FortiManager Cloud versions 6.4.1–6.4.7, 7.0.1–7.0.16, 7.2.1–7.2.12, 7.4.1–7.4.10, and 7.6.2–7.6.4. The vulnerability was published on September 8, 2026, and is currently awaiting full NVD analysis. It carries a CVSS v3.1 base score of 4.9 (Medium) (Feedly, Fortinet PSIRT).

The vulnerability is classified as CWE-284 (Improper Access Control). An authenticated administrator can craft specific HTTP or HTTPS requests that circumvent the workflow session approval process in FortiManager, effectively bypassing a security control designed to enforce multi-step authorization for sensitive administrative actions. Exploitation requires high privileges (administrator-level access) and network access to the FortiManager management interface, but no user interaction is needed. No public technical write-ups or proof-of-concept code have been identified at this time (Feedly, Fortinet PSIRT).

Successful exploitation allows an administrator to bypass the workflow approval process, enabling unauthorized or unreviewed changes to FortiManager-managed network device configurations. The primary impact is on integrity — an attacker with administrative credentials could push unapproved configuration changes to managed Fortinet devices, potentially weakening security posture across the managed network. There is no direct confidentiality or availability impact, but unauthorized configuration changes could facilitate further lateral movement or policy weakening across managed infrastructure (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-22575. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires high-privilege (administrator) access, significantly limiting the attacker pool (Feedly).

Fortinet has published advisory FG-IR-26-171 addressing this vulnerability. Administrators should upgrade to fixed versions of FortiManager and FortiManager Cloud as specified in the Fortinet PSIRT advisory. As an interim measure, restricting administrative access to the FortiManager management interface to trusted IP addresses and enforcing strict network segmentation can reduce exposure. Organizations should also review workflow session audit logs for any unauthorized approvals or configuration changes (Fortinet PSIRT).