7.5High

CVE-2026-22153

Fortinet FortiOS Published: 2026-02-10 18:39 (9 months ago)

Description

An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is configured in a specific way.

Weakness (CWE): CWE-305

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Fortinet	FortiOS	7.6.0 – ≤ 7.6.4

References and patches

https://fortiguard.fortinet.com/psirt/FG-IR-25-1052 Vendor Advisory

CPE matches (NVD) (1)

cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.6.0 < 7.6.5

CVSS score

7.5High

Source: fortinet · CVSS 3.1

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

All scores (2)

cna	CVSS 3.1	7.5High
psirt@fortinet.com	CVSS 3.1	8.1High

EPSS (chance of exploitation in 30 days)

0.75%

higher than 55% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2026-01-06
Published2026-02-10 18:39
Reached IP-DB2026-10-24 23:46
Last updated2026-11-06 18:42

Assigned by (CNA): fortinet
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Description

Affected products and versions

References and patches

CPE matches (NVD) (1)

Recent CVEs in the same product — Fortinet (all products)