Search threats, CVEs… ⌘K
Back to vendor advisories
Fortinet PSIRT AdvisoriesFG-IR-26-160

FGFM Authentication Weakening via CLI Configuration

CVSSv3 Score: 7.3 An Authentication Bypass Using an Alternate Path or Channel [CWE-288] vulnerability in FortiManager and FortiManager Cloud may allow a remote unauthenticated attacker to impersonate any FortiGate managed by the FortiManager with a specific CLI option set via crafted FGFM requests if the attacker has a valid certificate. Revised on 2026-08-12 00:00:00

Read the vendor bulletin Get alerts for FortiManager
7.3CVSS out of 10High severity
Scope

What the vendor says is affected

  • FortiManager
  • FortiManager Cloud
  • FortiGate
Timeline

When this advisory changed

  1. Published by Fortinet

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Keep investigating
See every advisory from this vendor