CVE-2026-22153

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22153", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-01-06T15:01:17.446Z", "datePublished": "2026-02-10T15:39:12.214Z", "dateUpdated": "2026-11-06T15:42:05.697Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiOS", "cpes": ["cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "7.6.0", "lessThanOrEqual": "7.6.4", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is configured in a specific way."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:05.697Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-305", "description": "Improper access control", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.5 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-25-1052", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-1052"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22153", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:56:21.036753Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:11.526Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22153", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:56:21.036753Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:55:04.748Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiOS", "versions": [{"status": "affected", "version": "7.6.0", "versionType": "semver", "lessThanOrEqual": "7.6.4"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.5 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-1052", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-25-1052"}], "descriptions": [{"lang": "en", "value": "An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is configured in a specific way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "Improper access control"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:05.697Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22153", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:42:05.697Z", "dateReserved": "2026-01-06T15:01:17.446Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2026-02-10T15:39:12.214Z", "assignerShortName": "fortinet"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiOS", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "7.6.4", "status": "affected", "version": "7.6.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "matchCriteriaId": "26DF2CCC-782C-4AE8-8CDE-13FFEE8676E6", "versionEndExcluding": "7.6.5", "versionStartIncluding": "7.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is configured in a specific way."}, {"lang": "es", "value": "Una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n por debilidad primaria [CWE-305] en Fortinet FortiOS 7.6.0 hasta 7.6.4 podr\u00eda permitir a un atacante no autenticado omitir la autenticaci\u00f3n LDAP de la pol\u00edtica de VPN sin agente o FSSO, cuando el servidor LDAP remoto est\u00e1 configurado de una manera espec\u00edfica."}], "id": "CVE-2026-22153", "lastModified": "2026-06-17T10:19:27.010", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "psirt@fortinet.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22153", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T04:56:21.036753Z", "version": "2.0.3"}}]}, "published": "2026-02-10T16:16:11.050", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-1052"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.6.0,7.6.4]"}}], "product": "fortios", "vendor": "fortinet"}], "analysis": {"en": {"generated_at": "2026-04-18T12:50:57.323446+00:00", "value": {"mitigation_remediation": ["Upgrade Fortinet FortiOS to version 7.6.5 or 8.0.0 and above.", "Reconfigure the remote LDAP server or FortiOS LDAP settings to remove the specific configuration that triggers the bypass.", "Monitor authentication logs for anomalous attempts and verify that LDAP authentication functions correctly after the upgrade."], "summary": {"action": "Patch Now", "impact": "Authentication Bypass (LDAP)"}, "threat_synthesis": {"affected_systems": "FortiOS 7.6.0, 7.6.1, 7.6.2, 7.6.3, and 7.6.4 from Fortinet are impacted. Upgrading to FortiOS 7.6.5 or any 8.0.0 release removes the vulnerability. System administrators should verify that their deployment runs a patched version.", "description_and_impact": "Fortinet FortiOS versions 7.6.0 through 7.6.4 contain a flaw that may allow an unauthenticated attacker to bypass LDAP authentication for Agentless VPN or FSSO policies when the remote LDAP server is configured in a particular way. This bypass undermines the authentication mechanism, potentially enabling an attacker to connect to protected resources without valid credentials. The weakness is classified as CWE-305, an authentication bypass due to insufficient credential handling.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity risk, while the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in CISA\u2019s KEV catalog. The attack vector is remote, as an unauthenticated attacker could target the VPN or FSSO service to trigger the bypass."}}}}, "created": "2026-02-10T21:42:08.786825+00:00", "updated": "2026-04-18T13:00:08.729217+00:00", "vendors": ["fortinet", "fortinet$PRODUCT$fortios"]}