PT-2026-24242 · Fortinet · Fortianalyzer+3

Published 2026-03-10 · Updated 2026-03-17 · CVE-2026-22629

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiAnalyzer versions 6.4 through 7.6.4 Fortinet FortiManager versions 6.4 through 7.6.4 Fortinet FortiAnalyzer Cloud versions 6.4 through 7.6.4 Fortinet FortiManager Cloud versions 6.4 through 7.6.4

Description The issue involves an insufficient restriction of excessive authentication attempts. This can allow an attacker to bypass brute-force protections by exploiting race conditions. The exploitation of race conditions increases the complexity of practical exploitation.

Recommendations Fortinet FortiAnalyzer versions 6.4 through 7.6.4: Update to a newer version that addresses this issue. Fortinet FortiManager versions 6.4 through 7.6.4: Update to a newer version that addresses this issue. Fortinet FortiAnalyzer Cloud versions 6.4 through 7.6.4: Update to a newer version that addresses this issue. Fortinet FortiManager Cloud versions 6.4 through 7.6.4: Update to a newer version that addresses this issue.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2026-03212

CVE-2026-22629

Affected Products

Fortianalyzer

Fortianalyzer Cloud

Fortimanager

Fortimanager Cloud

References · 9

• https://bdu.fstec.ru/vul/2026-03212 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-26-079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22629 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22629 · Vendor Advisory
• https://t.me/cveNotify/155423 · Telegram Post
• https://twitter.com/infoflowcloud/status/2033995941506629750 · Twitter Post
• https://twitter.com/0dayPublishing/status/2032149372822057120 · Twitter Post
• https://t.me/cveNotify/155333 · Telegram Post
• https://twitter.com/CVEnew/status/2033994313592651837 · Twitter Post