CVE-2026-22153

HIGH

FortiOS 7.6.0-7.6.4 - Unauthenticated Authentication Bypass via LDAP Configuration

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2026-22153. PoCs published by XiaomingX, glitchhawks, washingtonmaister.

AI-analyzed exploit summary The repository claims to provide an exploit for an authentication bypass vulnerability in Fortinet FortiOS but lacks actual exploit code, instead directing users to an external download link. The README contains vague descriptions without technical details.

Description

An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is configured in a specific way.

Exploits (3)

github SUSPICIOUS 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-22153

The repository claims to provide an exploit for an authentication bypass vulnerability in Fortinet FortiOS but lacks actual exploit code, instead directing users to an external download link. The README contains vague descriptions without technical details.

Classification
Suspicious 90%
Attack Type
Auth Bypass
Complexity
Theoretical
Reliability
Theoretical
Target: Fortinet FortiOS 7.6.0 through 7.6.4
No auth needed
Prerequisites: specific LDAP server configurations
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WRITEUP 4 stars
by glitchhawks · poc
https://github.com/glitchhawks/CVE-2026-22153

The repository provides a detailed description of CVE-2026-22153, an authentication bypass vulnerability in Fortinet FortiOS versions 7.6.0 through 7.6.4. It explains the vulnerability's impact and prerequisites but does not include actual exploit code.

Classification
Writeup 90%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Theoretical
Target: Fortinet FortiOS 7.6.0 through 7.6.4
No auth needed
Prerequisites: Specific LDAP server configurations · Agentless VPN or FSSO policies
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SUSPICIOUS 4 stars
by washingtonmaister · poc
https://github.com/washingtonmaister/CVE-2026-22153-exp

The repository claims to be a PoC for CVE-2026-22153 affecting FortiOS versions 7.6.0 to 7.6.4, but only contains a README with no actual exploit code. The README includes links to external sources (tinyurl.com) which are suspicious and could be phishing or malware distribution vectors.

Classification
Suspicious 30%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: FortiOS 7.6.0 <= 7.6.4
No auth needed
Prerequisites: none provided
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0070
EPSS Percentile 48.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-305
Status published
Products (1)
fortinet/fortios 7.6.0 - 7.6.5
Published Feb 10, 2026
Tracked Since Feb 18, 2026