An Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) exists in multiple Fortinet products. The flaw allows an attacker who holds a valid FortiCloud account and has a registered device to authenticate to other devices registered under different accounts when FortiCloud SSO is enabled, effectively bypassing normal authentication controls and granting full administrative access to those systems.

Affected products include FortiAnalyzer (versions 7.0.0–7.6.5, 7.4.0–7.4.9, 7.2.0–7.2.11), FortiManager (7.0.0–7.6.5, 7.4.0–7.4.9, 7.2.0–7.2.11), FortiOS (7.0.0–7.6.5, 7.4.0–7.4.10, 7.2.0–7.2.12), FortiProxy (7.0.0–7.6.4, 7.4.0–7.4.12, 7.2.0–7.2.15), and FortiWeb (7.4.0–7.4.11, 7.6.0–7.6.6, 8.0.0–8.0.3).

The vulnerability has a CVSS score of 9.4 and an EPSS score of 4%, indicating a high severity and a moderate likelihood of exploitation. It is listed in the CISA KEV catalog, signifying that known exploits exist. Exploitation requires the attacker to have a FortiCloud account and a registered device; the attack vector is remote, relying on the FortiCloud SSO authentication path used by the affected devices. Successful exploitation grants the attacker full control over the compromised device, potentially expanding reach to other network assets.