CVE-2024-26009

HIGH

Fortinet Fortiswitchmanager < 7.0.4 - Authentication Bypass

Title source: rule
STIX 2.1

Description

An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.15, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0013
EPSS Percentile 32.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-288
Status published
Products (15)
Fortinet/FortiOS 6.0.0 - 6.0.18
fortinet/fortios 6.0.0 - 6.2.17
Fortinet/FortiOS 6.2.0 - 6.2.16
Fortinet/FortiOS 6.4.0 - 6.4.15
Fortinet/FortiPAM 1.0.0 - 1.0.3
fortinet/fortipam 1.0.0 - 1.2.0
Fortinet/FortiPAM 1.1.0 - 1.1.2
Fortinet/FortiPAM 1.2.0
Fortinet/FortiProxy 7.0.0 - 7.0.15
fortinet/fortiproxy 7.0.0 - 7.0.16
... and 5 more
Published Aug 12, 2025
Tracked Since Feb 18, 2026