CVE-2026-22572

An authentication bypass using an alternate path or channel vulnerability (CWE-288) allows an attacker who knows an administrator’s password to bypass multifactor authentication checks by submitting multiple crafted requests. This flaw, present in FortiAnalyzer and FortiManager firmware versions 7.6.0‑7.6.3, 7.4.0‑7.4.7, and 7.2.2‑7.2.12, is a privilege‑escalation vulnerability that compromises authentication integrity, potentially granting unauthorized access to the systems and sensitive data.

Fortinet FortiAnalyzer versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, and 7.2.2 through 7.2.12, as well as FortiManager versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, and 7.2.2 through 7.2.12 are affected. The vulnerability is tied to the firmware and system software in these product lines.

This CVE represents a CWE-288: Authentication Bypass vulnerability. The CVSS score of 6.8 places this as a medium severity issue, but the low EPSS score (< 1%) indicates a small chance of current exploitation. It is not listed in CISA’s KEV catalog. The attack vector requires knowledge of an admin password and the ability to send crafted HTTP requests to the management interface. It is inferred from the description that exposure to untrusted or semi‑trusted traffic may increase the likelihood of exploitation because the bypass can be enacted without additional authentication. Until patched, exposed devices should be isolated or access restricted until the vulnerability is mitigated.