Loading story…
Fortinet disclosed CVE-2026-70468, a high-severity authentication bypass flaw in FortiManager and FortiManager Cloud that could let an unauthenticated remote attacker gain improper access to vulnerable systems. The issue is tracked as CWE-288 and carries a CVSS v3.1 score of 8.1. Affected versions include FortiManager and FortiManager Cloud 7.6.1, 7.4.3 through 7.4.5, and 7.2.5 through 7.2.9, and Fortinet has directed customers to install fixed releases and vendor patches.
A related Canadian Centre for Cyber Security notice, AV26-812, said multiple Fortinet products are affected, naming FortiClientWindows, FortiManager, and FortiManager Cloud across several version branches. The advisory did not publish exploit details, but urged administrators to review Fortinet PSIRT and FortiGuard guidance and apply updates as they become available, underscoring the need for rapid patching across exposed management infrastructure.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-812 stating that Fortinet products were affected by a vulnerability. The notice listed affected versions of FortiClientWindows, FortiManager, and FortiManager Cloud and directed users to review Fortinet PSIRT and FortiGuard Labs resources and apply updates as available.
The CVE entry for CVE-2026-70468 was published, documenting an authentication bypass flaw in FortiManager and FortiManager Cloud with a CVSS v3.1 score of 8.1. Affected versions listed include FortiManager and FortiManager Cloud 7.6.1, 7.4.3 through 7.4.5, and 7.2.5 through 7.2.9.
Fortinet published advisory FG-IR-26-160 for CVE-2026-70468, describing a high-severity authentication bypass vulnerability affecting FortiManager and FortiManager Cloud. The issue is remotely exploitable, mapped to CWE-288, and Fortinet advised customers to update to fixed versions and review access controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed **CWE-602** authorization bypass flaws in **FortiManager** and **FortiAnalyzer** that let authenticated low-privilege users reach privileged web-console functions and perform unauthorized operations by sending crafted requests. The advisories say affected releases span multiple **FortiManager**, **FortiAnalyzer**, and **FortiAnalyzer-BigData** branches, while newer branches such as **FortiAnalyzer 7.6** and **FortiManager 7.6** are not affected and fixed versions are available for supported lines. Fortinet credited researchers from **Orange Cyberdéfense**, **Orange CERT-CC**, and **Synacktiv** for responsible disclosure. Synacktiv detailed how the FortiManager issue, tracked as **`CVE-2024-23666`**, allowed a user with read-only or restricted privileges to access administrative features including full configuration backup, configuration import upload, and the remote SSH web console for managed **FortiGate** devices. Exported backups could expose hashed or encrypted credentials for FortiManager and managed devices, enabling further privilege escalation, and the configuration import path could be chained with **`CVE-2023-42791`** to obtain root access on the underlying system. The researchers also published detection guidance aimed at spotting suspicious configuration downloads by non-admin accounts.
Jul 9, 2026
Fortinet disclosed two critical vulnerabilities affecting **FortiWeb** and **FortiManager**, both of which have been exploited in the wild and can lead to full device compromise. In FortiWeb, multiple versions are affected by an unauthenticated SQL injection flaw that lets attackers send crafted HTTP or HTTPS requests to execute unauthorized SQL commands, bypass access controls, read sensitive configuration and user data, alter or delete database records, and potentially escalate to complete system takeover. Fortinet advised customers to upgrade immediately to fixed releases or disable the HTTP/HTTPS management interface as a temporary workaround. In FortiManager, the critical flaw tracked as `CVE-2024-47575` allows unauthenticated remote code execution and remote command execution, with exploitation observed globally and against Finnish organizations. A successful attack can give intruders control of vulnerable FortiManager systems and expose connected device configuration data and passwords. Fortinet issued patches for most affected branches, while **FortiManager Cloud 6.4** has no fix and must be upgraded; the company also warned that if exploitation is suspected, patching alone is insufficient and organizations should perform a full incident investigation using Fortinet’s compromise-assessment guidance.
Jun 29, 2026
Fortinet disclosed **CVE-2026-24858**, a **critical authentication bypass** (CVSS 9.8, **CWE-288: Alternate Authentication Path**) affecting Fortinet products that support *FortiCloud SSO*. When FortiCloud SSO is enabled, an attacker with a **FortiCloud account** and a **registered device** can potentially authenticate to **other organizations’ devices** registered to different FortiCloud accounts, effectively bypassing expected administrative authentication controls. Fortinet reported **in-the-wild exploitation** prior to patch availability, attributing activity to **two attacker-controlled FortiCloud accounts** that were subsequently blocked. Impacted versions include **FortiAnalyzer** (7.0.0–7.0.15, 7.2.0–7.2.11, 7.4.0–7.4.9, 7.6.0–7.6.5), **FortiManager** (7.0.0–7.0.15, 7.2.0–7.2.11, 7.4.0–7.4.9, 7.6.0–7.6.5), and **FortiOS** (7.0.0–7.0.18, 7.2.0–7.2.12, 7.4.0–7.4.10, 7.6.0–7.6.5), with fixed releases available in the corresponding patched branches. Recommended actions include **urgent patching**, **disabling FortiCloud SSO where feasible**, and reviewing authentication/audit logs for anomalous FortiCloud SSO login activity.
Jun 29, 2026