CVE-2026-22575: Fortinet FortiManager Auth Bypass Vulnerability

CVE-2026-22575 Overview

CVE-2026-22575 is an improper access control vulnerability [CWE-284] in Fortinet FortiManager and FortiManager Cloud. The flaw allows an authenticated administrator to bypass the approval process for workflow sessions by sending crafted HTTP or HTTPS requests. Successful exploitation undermines the multi-party review controls that FortiManager workflow mode is designed to enforce, allowing configuration changes to reach managed devices without proper authorization.

Critical Impact
An authenticated administrator can bypass workflow session approval on FortiManager, pushing unreviewed configuration changes to managed Fortinet devices across an enterprise fleet.

Affected Products

Fortinet FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.10, and all 7.2 versions
Fortinet FortiManager Cloud 7.6.2 through 7.6.4 and 7.4.1 through 7.4.10
Fortinet FortiManager Cloud 7.2 (all versions)

Discovery Timeline

2026-09-08 - CVE-2026-22575 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-22575

Vulnerability Analysis

FortiManager workflow mode is a change-control feature that requires configuration changes to move through defined review and approval stages before deployment. CVE-2026-22575 breaks that control. An administrator with an authenticated session can issue crafted HTTP or HTTPS requests that transition a workflow session past its approval gate without the required sign-off.

The bypass affects the integrity of policy pushes across every device the FortiManager instance manages. Because FortiManager is the central policy authority for FortiGate firewalls, SD-WAN edges, and other Fortinet appliances, an unauthorized change can propagate rapidly to production traffic paths. The vulnerability does not disclose information or crash the service, which is consistent with the impact scope described in Fortinet advisory FG-IR-26-171.

Root Cause

The root cause is missing or incomplete server-side authorization on the workflow session state transition. The API endpoints that advance a workflow session accept requests from any authenticated administrator instead of validating that the caller holds the approver role for that session. This is a classic broken access control pattern classified under [CWE-284].

Attack Vector

Exploitation requires network access to the FortiManager management interface and valid administrator credentials. The attacker crafts an HTTP or HTTPS request targeting the workflow approval endpoint and submits it against an in-progress workflow session. No user interaction is required and the attack complexity is low.

Because a legitimate credential is required, this vulnerability is most relevant in insider threat scenarios, compromised administrator account scenarios, and post-exploitation lateral movement where an attacker has already staged access to the management plane. See the Fortinet Security Advisory FG-IR-26-171 for vendor technical details.

Detection Methods for CVE-2026-22575

Indicators of Compromise

Workflow sessions transitioning from pending to approved status without a corresponding approver login event in the audit log
Configuration installs to managed FortiGate devices that reference workflow session IDs with no reviewer entry
HTTP or HTTPS requests to FortiManager workflow API endpoints originating from administrator accounts that do not hold approver rights

Detection Strategies

Compare the FortiManager workflow audit trail against configuration change deployment logs and flag installs that lack an approval record
Alert on any workflow session state change performed by an administrator account outside the assigned reviewer group
Baseline normal API call patterns to /cgi-bin/ workflow endpoints and detect anomalous request sequences from a single session

Monitoring Recommendations

Forward FortiManager elog and alog event streams to a centralized SIEM for correlation with identity and change-management data
Track administrator session origins, user-agent strings, and source IP ranges to identify credential misuse
Review scheduled and ad-hoc policy install jobs daily until systems are patched

How to Mitigate CVE-2026-22575

Immediate Actions Required

Upgrade FortiManager and FortiManager Cloud to a fixed release as listed in Fortinet advisory FG-IR-26-171
Restrict management-plane network access to a dedicated administrative subnet and jump hosts
Rotate administrator credentials and enforce multi-factor authentication on all FortiManager admin accounts
Audit recent workflow session approvals and policy installs for unauthorized changes

Patch Information

Fortinet has published fixed builds in the FG-IR-26-171 advisory covering the affected 7.6, 7.4, and 7.2 branches for both FortiManager and FortiManager Cloud. Administrators should consult the advisory for the exact target build for each installed branch and schedule an upgrade window. No official workaround is documented as a substitute for patching.

Workarounds

Limit the number of accounts with administrator role membership to reduce the pool of principals able to trigger the bypass
Segment the FortiManager GUI and API behind a management VPN or bastion host that enforces per-user access policies
Enable and review workflow email notifications so out-of-band approvals surface quickly to security operations

bash

# Restrict FortiManager admin access to trusted hosts
config system admin user
    edit "admin"
        set trusthost1 10.10.0.0 255.255.255.0
        set two-factor fortitoken
    next
end