Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

Fortinet FortiAnalyzer and FortiManager: Easy Password Guessing

CVE-2026-22629 · published 7 months ago
Summary

Fortinet's FortiAnalyzer and FortiManager products have a security weakness that makes it easier for hackers to try many passwords in quick succession, potentially allowing them to guess a user's password even if it's difficult to crack. This affects multiple versions of the software, including those used in cloud environments. Fortinet recommends applying the latest security patches to address this issue.

What to do
  • Update fortinet fortianalyzer to version 7.6.5 or later.
  • Update fortinet fortianalyzer_cloud to version 7.6.5 or later.
  • Update fortinet fortimanager to version 7.6.5 or later.
  • Update fortinet fortimanager_cloud to version 7.6.5 or later.
Affected software
VendorProductAffected versions
fortinet fortianalyzer >= 6.4.0, < 7.6.5
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
fortinet fortianalyzer_cloud >= 6.4.0, < 7.6.5
cpe:2.3:a:fortinet:fortianalyzer_cloud:*:*:*:*:*:*:*:*
fortinet fortimanager >= 6.4.0, < 7.6.5
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
fortinet fortimanager_cloud >= 6.4.0, < 7.6.5
cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*
Original advisory text
An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyz...
An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4 all versions, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4 all versions, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4 all versions, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions, FortiManager Cloud 6.4 all versions may allow an attacker to bypass bruteforce protections via exploitation of race conditions. The latter raises the complexity of practical exploitation.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-307Improper Restriction of Excessive Authentication Attempts
Timeline
Published10 Mar 2026
Updated4 Nov 2026
First seen11 Mar 2026
Sources
CVE-2026-22629 · NVD
Track software like this
Free during beta