Fortinet FortiAnalyzer and FortiManager products contain an improper restriction of excessive authentication attempts. The flaw can be exploited via race conditions during login attempts, allowing an attacker to bypass built‑in brute‑force protections. Successful exploitation could enable unauthorized access to administrative or user accounts, potentially leading to full system compromise and lateral movement. Although practical exploitation is complex, the vulnerability enables a potential account takeover.

The vulnerability affects Fortinet FortiAnalyzer products running firmware versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.10, all 7.2 releases, all 7.0 releases, and all 6.4 releases. FortiAnalyzer Cloud is affected for firmware 7.6.2, 7.4.1 through 7.4.7, 7.2.1 through 7.2.10, 7.0.1 through 7.0.14, and all 6.4 releases. FortiManager devices run affected firmware 7.6.0 through 7.6.4, 7.4.0 through 7.4.10, all 7.2 releases, all 7.0 releases, and all 6.4 releases. FortiManager Cloud vulnerabilities exist in firmware 7.6.2 through 7.6.3, 7.4.1 through 7.4.7, 7.2.1 through 7.2.10, 7.0.1 through 7.0.14, and all 6.4 releases.

The CVSS score of 3.4 indicates a low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, indicating no known active exploitation. However, the attack requires local or remote access to an authentication service and benefits from a race condition, making practical exploitation difficult but not impossible. Due to the potential for account takeover, administrators should treat the impact as significant and prioritize remediation.