Fortinet RADIUS certificate flaw lets MITM impersonate the server
Original title: Improper certificate validation in RADIUS protocol
A rogue RADIUS server can be impersonated against FortiSASE Sovereign, FortiManager and FortiAnalyzer products, scored CVSS 7.5.
Fortinet PSIRT revised FG-IR-26-247 on November 10 for improper certificate validation in the RADIUS protocol of FortiSASE Sovereign, FortiManager, Fortianalyzer, FortiManager Cloud and FortiAnalyzer Cloud. A man-in-the-middle attacker may impersonate the RADIUS server using a rogue RADIUS server. Versions, fixes and exploitation are not stated.
Unconfirmed: The snippet does not state affected versions, a fix, or known attacks.
- CVSSv3 score is 7.5; the weakness is CWE-295.
- The attacker must be in a man-in-the-middle position.
- Cloud and on-premises FortiManager and FortiAnalyzer are both listed.
Impact: MITM attacker can impersonate the RADIUS server
| Product | Affected |
|---|---|
| Fortinet FortiSASE Sovereign | — |
| Fortinet FortiManager | — |
| Fortinet Fortianalyzer | — |
| Fortinet FortiManager Cloud | — |
| Fortinet FortiAnalyzer Cloud | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 5 An Improper Certificate Validation vulnerability [CWE-295] in FortiSASE Sovereign, FortiManager, Fortianalyzer, FortiManager Cloud and FortiAnalyzer Cloud RADIUS protocol may allow a MITM attacker to impersonate the radius server via a rogue RADIUS server. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.