Fortinet sshd path traversal can bypass authentication without login
Original title: Improper neutralization of special elements in output used by a downstream component in sshd
The CVSS 7.4 issue also covers FortiSASE, FortiProxy and FortiPam; the notice lists no versions or exploitation.
Fortinet PSIRT describes a path traversal flaw in the ssh daemon of FortiOS, FortiSASE, FortiProxy and FortiPam. An unauthenticated attacker may bypass authentication using specially crafted credentials. The notice, FG-IR-26-269, was revised on November 10 and scores the issue CVSS v3 7.4. Ranges and fixes are absent from the snippet.
Unconfirmed: Affected versions, fixes, CVE identifiers and exploitation status are not stated.
- The weakness is classified as CWE-24 path traversal.
- Fortinet tracks the issue as FG-IR-26-269.
- The notice was revised on November 10, 2026.
- The snippet names no affected or fixed versions.
Impact: unauthenticated authentication bypass via crafted credentials
| Product | Affected |
|---|---|
| Fortinet FortiOS | — |
| Fortinet FortiSASE | — |
| Fortinet FortiProxy | — |
| Fortinet FortiPam | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 7. 4 A Path Traversal vulnerability [cwe-24] in FortiOS, FortiSASE, FortiProxy and FortiPam ssh daemon may allow an unauthenticated attacker to bypass authentication via specially crafted credentials. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.