CVE-2026-22575 in FortiManager
Summary
by MITRE • 09/08/2026
An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in Fortinet FortiManager represents a critical failure in access control mechanisms within the application's workflow management subsystem. This flaw affects multiple major releases of the software, specifically versions 7.6 through 7.6.4, 7.4 through 7.4.10, and all versions of the legacy 7.2 branch, as well as their corresponding cloud-hosted counterparts. The core issue stems from an improper implementation of authorization checks when handling HTTP or HTTPS requests related to workflow sessions. In a properly secured environment, administrative actions that modify system configurations or execute critical operations should require explicit approval through a defined multi-step process. However, the vulnerability allows an authenticated administrator to circumvent this mandatory approval gate by sending specifically crafted network packets directly to the backend API endpoints.
From a technical perspective, this flaw is classified under CWE-269, which denotes Improper Privilege Management, and more specifically aligns with CWE-862 regarding Missing Authorization checks. The attacker leverages their existing administrative privileges but exploits the lack of server-side validation on specific workflow states. By manipulating the HTTP request parameters or headers, the administrator can force the system to transition a workflow session into an approved state without undergoing the requisite peer review or secondary authorization step. This bypass is possible because the application fails to verify that the approval action was initiated through the legitimate user interface flow rather than directly via API manipulation. The vulnerability essentially decouples the execution of administrative tasks from their governance controls, rendering the audit trail and compliance mechanisms ineffective for affected workflow types.
The operational impact of this vulnerability is significant for organizations relying on FortiManager for centralized security policy management. Workflow approval processes are typically implemented to enforce separation of duties, ensuring that changes proposed by one administrator are reviewed and validated by another before being applied to managed devices such as firewalls or switches. By bypassing this process, a malicious insider with administrative access can push unauthorized configuration changes directly to the network infrastructure without detection through standard audit logs associated with workflow approvals. This undermines change management protocols required by frameworks like ISO 27001 and NIST SP 800-53, potentially leading to unapproved security policy modifications that could weaken perimeter defenses or expose internal networks to threats. Furthermore, it compromises the integrity of configuration backups and version control systems tied to these workflows.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK technique T1484.002, Domain Policy Modification, where an adversary alters domain policies to establish persistence or escalate privileges within a network environment. It also relates to T1530, Data from Information Repositories, if the bypassed workflows involve accessing sensitive configuration data that should have been restricted by approval gates. The ability to manipulate these sessions via crafted HTTP requests indicates that the vulnerability is exploitable remotely over the network provided the attacker has valid administrative credentials. This highlights a common challenge in enterprise security appliances where API endpoints may not enforce the same strict state transitions as the graphical user interface, creating an attack surface for privilege abuse by insiders or compromised accounts.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is to apply the vendor-provided software patches that address these specific version ranges immediately upon availability. Organizations should verify their FortiManager instances against the affected versions listed in the advisory and prioritize updates for systems handling critical infrastructure changes. In addition to patching, administrators should review access logs for anomalies indicating direct API calls to workflow endpoints outside of standard UI interactions. Implementing strict network segmentation to limit administrative access to trusted management networks can reduce the risk of exploitation if credentials are compromised. Furthermore, organizations should consider implementing additional monitoring rules that detect rapid succession of approval requests or changes in workflow status that do not correlate with expected user activity patterns. Regular audits of configuration change logs against approved tickets will help identify any instances where this bypass may have been exploited prior to patching.