CVE-2026-22575
Last modified
CVE-2026-22575 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests..
Description
An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiManager | >= 7.6.0, <= 7.6.4; >= 7.4.0, <= 7.4.10; >= 7.2.0, <= 7.2.12; >= 7.0.0, <= 7.0.16; >= 6.4.0, <= 6.4.15 |
| Fortinet | FortiManager Cloud | >= 7.6.2, <= 7.6.4; >= 7.4.1, <= 7.4.10; >= 7.2.1, <= 7.2.12; >= 7.0.1, <= 7.0.16; >= 6.4.1, <= 6.4.7 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-22575?
How severe is CVE-2026-22575?
How do I fix CVE-2026-22575?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-22568Improper neutralization of special elements in user-supplied…2.7
- CVE-2026-22569An incorrect startup configuration of affected versions of Z…5.3
- CVE-2026-2257The GetGenie plugin for WordPress is vulnerable to Insecure …6.4
- CVE-2026-22572An authentication bypass using an alternate path or channel …7.2
- CVE-2026-22573An improper limitation of a pathname to a restricted directo…6.5
- CVE-2026-22574A storing passwords in a recoverable format vulnerability in…6.5
- CVE-2026-22576A storing passwords in a recoverable format vulnerability in…6.5
- CVE-2026-22577Rejected reason: Not used
- CVE-2026-22578Rejected reason: Not used
- CVE-2026-22579Rejected reason: Not used
- CVE-2026-2258A flaw has been found in aardappel lobster up to 2025.4. Aff…5.5
- CVE-2026-22580Rejected reason: Not used
Are you affected by CVE-2026-22575?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST