Loading story…
Fortinet has disclosed a critical security vulnerability in its FortiPAM privileged access management solution, identified as CVE-2025-49201. This vulnerability is caused by weak authentication in the GUI component of several FortiPAM versions, including all releases of 1.0, 1.1, 1.2, and 1.3, as well as versions 1.4.0 through 1.4.2 and 1.5.0. The flaw allows remote, unauthenticated attackers to execute unauthorized code or commands by sending specially crafted HTTP requests to the affected system. Security researchers and Fortinet’s own Product Security Incident Response Team (PSIRT) have confirmed that exploitation of this vulnerability could result in complete system compromise, giving attackers full control over privileged access management infrastructure. The vulnerability is rated as high severity, with a CVSS score of 7.4 according to runZero and 8.1 according to CVEfeed, reflecting the significant risk posed to organizations using vulnerable FortiPAM deployments. FortiPAM is widely used to manage and monitor privileged access to sensitive IT and OT assets, making exploitation of this flaw particularly dangerous for organizations with critical infrastructure. Fortinet has released security advisories and recommends immediate upgrades to fixed versions: users of FortiPAM 1.4 should upgrade to 1.4.3 or later, and those on 1.5 should move to 1.5.1 or later. For earlier versions (1.0 through 1.3), migration to a fixed release is required. The vulnerability also affects FortiSwitchManager versions 7.2.0 through 7.2.4, broadening the potential attack surface. Organizations are urged to identify vulnerable assets in their environments, with runZero providing specific asset inventory queries to assist in detection. No workarounds have been detailed, making patching the only effective mitigation. The vulnerability was publicly disclosed on October 14, 2025, and Fortinet has provided technical details and remediation guidance through its official channels. Security teams should prioritize patching due to the remote exploitability and the critical role of FortiPAM in managing privileged access. The exposure of privileged credentials and session monitoring functions could have cascading impacts if exploited, including lateral movement and further compromise of sensitive systems. The vulnerability underscores the importance of timely patch management and continuous asset discovery for privileged access management solutions. Organizations should also review access logs and monitor for signs of unauthorized activity on FortiPAM systems. Given the high-profile nature of Fortinet products in enterprise environments, threat actors may rapidly attempt to exploit unpatched systems. Fortinet’s PSIRT remains the authoritative source for updates and further technical advisories regarding CVE-2025-49201.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
runZero publishes a blog post explaining how to find Fortinet FortiPAM assets on a network, likely in response to the newly disclosed FortiPAM vulnerability. This represents public defensive guidance rather than a new incident.
A high-severity vulnerability, CVE-2025-49201, affecting Fortinet FortiPAM and described as an authentication bypass, is publicly listed. The reference does not provide additional technical details or a vendor remediation date.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has added two critical authentication bypass vulnerabilities, CVE-2025-59718 and CVE-2025-59719, affecting multiple Fortinet products—including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager—to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation. These flaws stem from improper verification of cryptographic signatures in the FortiCloud Single Sign-On (SSO) mechanism, allowing unauthenticated attackers to bypass authentication via specially crafted SAML messages. Fortinet has released advisories and patches, and CISA has set a remediation deadline for federal agencies, urging immediate patching or, if not possible, discontinuation of affected products until mitigations are in place. The vulnerabilities are not enabled by default but can be activated during FortiCare registration unless administrators disable the relevant SSO toggle. Security researchers have observed exploitation attempts shortly after the patch release, highlighting the urgency for organizations to update their systems. CISA's guidance mandates compliance with BOD 22-01 for federal agencies, and all organizations using affected Fortinet products are strongly advised to apply patches or disable the vulnerable SSO feature to prevent unauthorized access to their networks.
Jun 29, 2026
Fortinet disclosed **CVE-2026-70468**, a high-severity authentication bypass flaw in **FortiManager** and **FortiManager Cloud** that could let an unauthenticated remote attacker gain improper access to vulnerable systems. The issue is tracked as **CWE-288** and carries a **CVSS v3.1 score of 8.1**. Affected versions include FortiManager and FortiManager Cloud `7.6.1`, `7.4.3` through `7.4.5`, and `7.2.5` through `7.2.9`, and Fortinet has directed customers to install fixed releases and vendor patches. A related **Canadian Centre for Cyber Security** notice, **AV26-812**, said multiple Fortinet products are affected, naming **FortiClientWindows**, **FortiManager**, and **FortiManager Cloud** across several version branches. The advisory did not publish exploit details, but urged administrators to review Fortinet PSIRT and FortiGuard guidance and apply updates as they become available, underscoring the need for rapid patching across exposed management infrastructure.
Aug 12, 2026
Fortinet has disclosed and patched two critical authentication bypass vulnerabilities, identified as CVE-2025-59718 and CVE-2025-59719, affecting multiple products including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. These flaws, rated with a CVSS score of 9.1, stem from improper verification of cryptographic signatures in the FortiCloud SSO login process. An unauthenticated attacker could exploit these vulnerabilities by sending a crafted SAML message, potentially gaining unauthorized administrative access if FortiCloud SSO is enabled. By default, FortiCloud SSO is disabled, but it is automatically enabled during FortiCare registration unless the administrator explicitly disables the relevant toggle. Fortinet has released fixed versions for all affected products and strongly recommends that organizations upgrade immediately. As a temporary mitigation, disabling the FortiCloud SSO login feature is advised until the upgrade can be completed. There is currently no evidence of exploitation in the wild, and no public proof-of-concept code is available, but the history of threat actors targeting Fortinet products underscores the urgency of patching. The vulnerabilities impact a range of versions across FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, with unaffected versions and upgrade paths detailed in the advisories.
Jun 29, 2026