CVE-2026-22575
published 2026-09-08CVE-2026-22575: An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions…
PriorityP429medium4.9CVSS 3.1
AVNACLPRHUINSUCNIHAN
EPSS
0.24%
14.8th percentile
An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortimanager | 6.4.0 – 6.4.15 | — |
| fortinet | fortimanager | 7.0.0 – 7.0.16 | — |
| fortinet | fortimanager | 7.2.0 – 7.2.12 | — |
| fortinet | fortimanager | 7.4.0 – 7.4.10 | — |
| fortinet | fortimanager | 7.6.0 – 7.6.4 | — |
| fortinet | fortimanager_cloud | 6.4.1 – 6.4.7 | — |
| fortinet | fortimanager_cloud | 7.0.1 – 7.0.16 | — |
| fortinet | fortimanager_cloud | 7.2.1 – 7.2.12 | — |
| fortinet | fortimanager_cloud | 7.4.1 – 7.4.10 | — |
| fortinet | fortimanager_cloud | 7.6.2 – 7.6.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Fortinet FortiManager/FortiManager Cloud access control (Nessus ID 349780)
vuldb·2026-09-25·CVSS 4.9
CVE-2026-22575 [MEDIUM] Fortinet FortiManager/FortiManager Cloud access control (Nessus ID 349780)
A vulnerability categorized as problematic has been discovered in Fortinet FortiManager and FortiManager Cloud. Impacted is an unknown function. Such manipulation leads to improper access controls.
This vulnerability is uniquely identified as CVE-2026-22575. The attack can be launched remotely. No exploit exists.
GHSA
An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiMa
ghsa_unreviewed·2026-09-08
CVE-2026-22575 [MEDIUM] CWE-284 An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiMa
An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-08
Published