CVE-2026-70468
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, 7.4.3 through 7.4.5, 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1, 7.4.3 through 7.4.5, 7.2.5 through 7.2.9 may allow attacker to improper access control.
Risk Assessment
An attacker may gain unauthorized access to device management, potentially leading to full infrastructure compromise.
Recommendation
It is recommended to upgrade FortiManager to the latest available version containing the fix and implement additional access controls.
Other vulnerabilities in FortiManager
See all- CVE-2024-47575CriticalActively exploited
A missing authentication for critical function in FortiManager and FortiManager Cloud allows an attacker to execute arbitrary code or commands via specially crafted requests.
- CVE-2026-106171Medium
An improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Fortinet FortiManager and FortiManager Cloud may allow an attacker to escalate privileges via specially crafted packets.
- CVE-2026-22575Medium
An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPS requests.
- CVE-2024-33503Medium
A privilege management vulnerability in Fortinet FortiManager and FortiManager Cloud allows unauthorized privilege escalation via specific shell commands. Affected versions include 7.4.0-7.4.3, 7.2.0-7.2.5, 7.0, and 6.4.
Original NVD description (English source)
A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1, FortiManager Cloud 7.4.3 through 7.4.5, FortiManager Cloud 7.2.5 through 7.2.9 may allow attacker to improper access control via <insert attack vector here>
Vulnerability data from NVD (NIST) · CISA KEV · EPSS