CVE-2026-22572: Fortinet FortiAnalyzer Auth Bypass Flaw

CVE-2026-22572 Overview

CVE-2026-22572 is an authentication bypass vulnerability affecting Fortinet FortiAnalyzer and FortiManager appliances. The flaw enables an attacker who already possesses an administrator's password to bypass multifactor authentication (MFA) checks by submitting multiple crafted requests. The issue is classified under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel) and carries a CVSS 3.1 base score of 7.2.

Fortinet disclosed the issue in advisory FG-IR-26-090. Successful exploitation grants full administrative access to the management plane, exposing network device configurations, logs, and downstream Fortinet infrastructure managed by these platforms.

Critical Impact

An attacker with valid administrator credentials can circumvent MFA on FortiAnalyzer and FortiManager, obtaining complete administrative control over the management plane and any devices it administers.

Affected Products

• Fortinet FortiAnalyzer 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, and 7.2.2 through 7.2.11
• Fortinet FortiManager 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, and 7.2.2 through 7.2.11
• Fortinet FortiManager Cloud (corresponding affected branches)

Discovery Timeline

• 2026-03-10 - CVE-2026-22572 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-22572

Vulnerability Analysis

The vulnerability stems from improper enforcement of the MFA stage in the authentication workflow of FortiAnalyzer and FortiManager. After supplying valid primary credentials, the affected systems fail to consistently require a successful second factor before issuing an authenticated session. An attacker who knows an administrator password can submit a sequence of crafted authentication requests that exercises an alternate path through the login state machine, completing authentication without satisfying the MFA check.

Because the bypass occurs after primary credential validation, it requires high privileges (PR:H) in the form of a known administrator password. Network reachability to the management interface is the only additional precondition. Once bypassed, the attacker inherits full administrative rights, compromising confidentiality, integrity, and availability of the device.

Root Cause

The root cause is an alternate channel in the authentication flow [CWE-288]. The MFA verification step does not authoritatively gate session issuance against all entry points into the login API. By replaying or reordering authentication requests, the secondary factor verification can be skipped or treated as satisfied.

Attack Vector

Exploitation requires network access to the FortiAnalyzer or FortiManager administrative interface and prior knowledge of an administrator password, obtained through credential theft, phishing, password reuse, or insider access. The attacker then issues multiple crafted requests against the login endpoint to obtain an authenticated session without supplying a valid MFA token. No user interaction is required.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Fortinet Security Advisory FG-IR-26-090 for vendor-provided technical details.

Detection Methods for CVE-2026-22572

Indicators of Compromise

• Multiple authentication attempts to FortiAnalyzer or FortiManager admin interfaces from the same source within a short window, particularly when followed by a successful login lacking a corresponding MFA challenge entry.
• Administrator logins originating from unusual source IP addresses, geolocations, or outside normal operational hours.
• Configuration changes, ADOM modifications, or device reassignments performed shortly after anomalous login sequences.

Detection Strategies

• Correlate authentication log entries on FortiAnalyzer and FortiManager to flag sessions where the primary credential event is not paired with a successful MFA verification event.
• Alert on bursts of repeated POST requests to the management login endpoint that culminate in an authenticated session.
• Track administrator session creation against the configured MFA policy and raise alerts on policy deviations.

Monitoring Recommendations

• Forward FortiAnalyzer and FortiManager authentication and audit logs to a central SIEM for retention and correlation against network and identity telemetry.
• Monitor administrative API endpoints for abnormal request rates, especially from non-management subnets.
• Review syslog and event logs daily for privileged configuration changes performed by accounts that recently authenticated.

How to Mitigate CVE-2026-22572

Immediate Actions Required

• Upgrade FortiAnalyzer and FortiManager to fixed versions as listed in Fortinet Security Advisory FG-IR-26-090.
• Restrict network access to the management interface to trusted administrative subnets and jump hosts.
• Rotate all administrator passwords on affected devices and audit accounts for unauthorized sessions or recent changes.
• Review audit logs across the affected version ranges (7.2.2–7.2.11, 7.4.0–7.4.7, 7.6.0–7.6.3) for signs of MFA bypass.

Patch Information

Fortinet has published fixed releases for FortiAnalyzer and FortiManager in the 7.2, 7.4, and 7.6 branches. Refer to the vendor advisory FG-IR-26-090 for the exact fixed build numbers applicable to each affected branch and for FortiManager Cloud guidance.

Workarounds

• Limit administrative access using trusthost configurations so only specific management IP addresses can reach the login interface.
• Place the management interface behind a VPN or zero-trust network access gateway that enforces independent MFA prior to reaching the device.
• Disable or remove unused administrator accounts and enforce strong, unique passwords to reduce the value of stolen credentials required to trigger the bypass.

# Configuration example: restrict administrator access to trusted hosts
config system admin
    edit "admin"
        set trusthost1 10.0.0.0 255.255.255.0
        set trusthost2 192.168.10.5 255.255.255.255
    next
end