CVE-2026-22628

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22628", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-01-08T06:49:28.869Z", "datePublished": "2026-03-10T16:44:01.494Z", "dateUpdated": "2026-11-06T15:42:08.550Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiSwitchAXFixed", "cpes": ["cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "1.0.0", "lessThanOrEqual": "1.0.1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute system commands via a specifically crafted SSH config file."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:08.550Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-284", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to FortiSwitchAXFixed version 1.0.2 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-085", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-085"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22628", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T20:28:35.428791Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T20:32:47.930Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22628", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T20:28:35.428791Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T20:30:16.838Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiSwitchAXFixed", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "semver", "lessThanOrEqual": "1.0.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to FortiSwitchAXFixed version 1.0.2 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-085", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-085"}], "descriptions": [{"lang": "en", "value": "An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute system commands via a specifically crafted SSH config file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:08.550Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22628", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:42:08.550Z", "dateReserved": "2026-01-08T06:49:28.869Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2026-03-10T16:44:01.494Z", "assignerShortName": "fortinet"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchaxfixed:1.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiSwitchAXFixed", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "1.0.1", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiswitchaxfixed:*:*:*:*:*:*:*:*", "matchCriteriaId": "1DE31518-C416-48C9-9B35-CA73232CDBB0", "versionEndExcluding": "1.0.2", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute system commands via a specifically crafted SSH config file."}, {"lang": "es", "value": "Una vulnerabilidad de control de acceso inadecuado en Fortinet FortiSwitchAXFixed 1.0.0 hasta 1.0.1 puede permitir a un administrador autenticado ejecutar comandos del sistema a trav\u00e9s de un archivo de configuraci\u00f3n SSH espec\u00edficamente dise\u00f1ado."}], "id": "CVE-2026-22628", "lastModified": "2026-06-17T10:20:11.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22628", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T20:28:35.428791Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:12.720", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-085"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "psirt@fortinet.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.0.1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FortiSwitchAXFixed", "source": "cna", "vendor": "Fortinet"}, "product": "fortiswitchaxfixed", "vendor": "fortinet"}], "analysis": {"en": {"generated_at": "2026-04-18T09:38:32.369637+00:00", "value": {"mitigation_remediation": ["Upgrade FortiSwitchAXFixed to version 1.0.2 or newer", "Upgrade FortiSwitchAX-Chassis to version 1.0.0 or newer", "Restrict write access to the SSH configuration directory so that only system processes can modify it"], "summary": {"action": "Immediate Patch", "impact": "Remote command execution via improper access control"}, "threat_synthesis": {"affected_systems": "Fortinet FortiSwitchAXFixed 1.0.0 and 1.0.1 are affected. Upgrading to FortiSwitchAXFixed 1.0.2 or newer, or FortiSwitchAX-Chassis 1.0.0 or newer, removes the vulnerability.", "description_and_impact": "An improper access control flaw in Fortinet FortiSwitchAXFixed versions 1.0.0 through 1.0.1 allows an authenticated administrator to craft a specially designed SSH configuration file that enables execution of arbitrary system commands on the device. The weakness permits the privileged user to run commands with the full operating\u2011system rights of the switch, potentially leading to complete compromise of the device\u2019s operating environment.", "risk_and_exploitability": "The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need legitimate administrator credentials and access to the device\u2019s SSH configuration, but once available, can issue arbitrary system commands. The impact is high for any privileged operator, enabling full control of the switch if the flaw is used."}}}}, "created": "2026-03-11T11:49:40.052962+00:00", "title": "Improper Access Control Enabling Remote Command Execution via SSH Config on FortiSwitchAXFixed", "updated": "2026-04-18T09:45:25.834263+00:00", "vendors": ["fortinet", "fortinet$PRODUCT$fortiswitchaxfixed"]}