CVE-2026-22575: 
Fortinet FortiManager vulnerability analysis and mitigation

CVE-2026-22575 is an improper access control vulnerability (CWE-284) in Fortinet FortiManager and FortiManager Cloud that may allow an authenticated administrator to bypass the workflow session approval process via crafted HTTP or HTTPS requests. It was disclosed on September 8, 2026, and affects FortiManager 6.4.0–6.4.15, 7.0.0–7.0.16, 7.2.x (all versions), 7.4.0–7.4.10, and 7.6.0–7.6.4, as well as FortiManager Cloud 6.4.1–6.4.7, 7.0.1–7.0.16, 7.2.x (all versions), 7.4.1–7.4.10, and 7.6.2–7.6.4. FortiManager 8.0 is not affected. The vulnerability carries a CVSS v3.1 base score of 4.7 (Medium) (Fortinet PSIRT).

The vulnerability is rooted in improper access control (CWE-284) within the FortiManager GUI component, specifically in the handling of workflow session approval requests. An authenticated administrator can craft malicious HTTP or HTTPS requests that circumvent the intended approval workflow, effectively bypassing a security control designed to enforce multi-step authorization for sensitive configuration changes. Exploitation requires an existing administrator account (high privileges), making it an authenticated attack vector with no user interaction required. No public proof-of-concept code has been identified at this time (Fortinet PSIRT).

Successful exploitation allows an authenticated administrator to bypass the workflow session approval process in FortiManager, resulting in unauthorized or unapproved configuration changes being applied to managed network devices. The primary impact is on integrity — an attacker with administrative access could push unapproved policy or configuration changes across managed Fortinet infrastructure without the required peer review or approval, potentially undermining change management controls. There is no direct confidentiality or availability impact as assessed by the CVSS scoring (Fortinet PSIRT).

There is no evidence of in-the-wild exploitation, and Fortinet has confirmed the vulnerability is not known to be exploited. No public proof-of-concept exploit code has been published. The EPSS score is approximately 0.0025 (0.25%), indicating a low probability of exploitation in the near term. The attack requires high privileges (administrator-level access), which significantly limits the attacker pool. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Fortinet PSIRT).

1. Authentication: Obtain valid administrator credentials for a vulnerable FortiManager instance (versions 7.6.0–7.6.4, 7.4.0–7.4.10, 7.2.x, 7.0.0–7.0.16, or 6.4.0–6.4.15).
2. Identify workflow session: Locate an active or pending workflow session within FortiManager that would normally require approval from another administrator before changes are applied.
3. Craft malicious request: Construct a specially crafted HTTP or HTTPS request targeting the workflow session approval endpoint, manipulating parameters or request structure to bypass the approval gate.
4. Submit bypass request: Send the crafted request to the FortiManager GUI, causing the system to process the workflow session as if it had been approved without going through the legitimate approval process.
5. Achieve unauthorized change: The unapproved configuration changes are applied to managed devices, bypassing the intended change management controls (Fortinet PSIRT).

• Logs: FortiManager audit logs showing workflow sessions transitioning to an approved or applied state without a corresponding approval action from a second administrator; unexpected HTTP/HTTPS requests to workflow session endpoints in web access logs.
• Configuration: Unanticipated policy or configuration changes applied to managed devices that do not correspond to approved change requests in the workflow audit trail.
• Behavioral: Administrator accounts approving their own workflow sessions or sessions being completed outside of normal business hours without documented approvals.

Fortinet has released patched versions to address this vulnerability. Affected users should upgrade to the following fixed releases: FortiManager 7.6.5 or above (for 7.6.x), FortiManager 7.4.11 or above (for 7.4.x), and FortiManager 8.0 (not affected). Users on FortiManager 7.2.x and FortiManager Cloud 7.2.x should migrate to a fixed release, as no patch is planned for those branches. FortiManager Cloud 7.6.x users should upgrade to 7.6.5 or above, and FortiManager Cloud 7.4.x users should upgrade to 7.4.11 or above when available. No specific configuration-based workaround has been published; upgrading is the recommended remediation (Fortinet PSIRT).

The vulnerability was reported to Fortinet by external researcher Martin Cechvala under responsible disclosure, and Fortinet acknowledged the contribution in their advisory. Coverage has been limited to vulnerability aggregation sites and threat intelligence feeds, with no significant public researcher commentary or social media discussion identified at this time (Fortinet PSIRT).