FORTINETVERIFIED
FGFM Authentication Weakening via CLI Configuration
Checked 8 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.
Open the official publisher source
← Lifecycle catalogue
SECURITY ADVISORYFORTINETVERIFIED
PUBLISHER UPDATE · FORTINET-PRODUCTS-0CFA15AE75B452E8
FORTINET-PRODUCTS-0CFA15AE75B452E8 release notes and known issues
FGFM Authentication Weakening via CLI Configuration
Scope: Fortinet products. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.
Summary
CVSSv3 Score: 7.3 An Authentication Bypass Using an Alternate Path or Channel [CWE-288] vulnerability in FortiManager and FortiManager Cloud may allow a remote unauthenticated attacker to impersonate any FortiGate managed by the FortiManager with a specific CLI option set via crafted FGFM requests if the attacker has a valid certificate. Revised on 2026-08-12 00:00:00
Improvements and security content
- CVSSv3 Score: 7.3 An Authentication Bypass Using an Alternate Path or Channel [CWE-288] vulnerability in FortiManager and FortiManager Cloud may allow a remote unauthenticated attacker to impersonate any FortiGate managed by the FortiManager with a specific CLI option set via crafted FGFM requests if the attacker has a valid certificate. Revised on 2026-08-12 00:00:00
Known issues
Publisher statementNot stated. The verified publisher record does not contain a known-issues statement.
Affected products and versions
Products
- Fortinet products
Affected versions
- 7.3
Fixed versions or updates
- No fixed version is stated in this record.
Recommended action
Review the official publisher document before deployment.