35
FGFM Authentication Weakening via CLI Configuration
FortiManager FGFM flaw (CVSS 7.3) lets an attacker with a valid certificate impersonate any managed FortiGate under a specific CLI option.
Fortinet advisory FG-IR-26-160 describes an authentication bypass via alternate path (CWE-288) in FortiManager and FortiManager Cloud, scored CVSSv3 7.3. A remote unauthenticated attacker holding a valid certificate can impersonate any FortiGate managed by the affected FortiManager when a specific CLI option is set. The impersonation is performed with crafted FGFM protocol requests. The advisory was revised on 2026-08-12 and does not report active exploitation.
40
Workflow session email approval process bypass
Fortinet disclosed an improper access control flaw (CVSS 4.7) in FortiManager allowing administrators to bypass workflow session email approval via crafted HTTP requests.
Fortinet advisory FG-IR-26-171 covers an improper access control vulnerability (CWE-284) in FortiManager, rated CVSSv3 4.7. An administrator can bypass the approval process for workflow sessions via crafted HTTP or HTTPS requests. The advisory was revised on 2026-09-08.
15
30
30
Tufin Orchestration Suite R20-2: Users can evaluate network access risks and minimize attack surface
30