Critical Fortinet Vulnerabilities Enable Auth Bypass

Multiple vulnerabilities have been identified across Fortinet products including FortiOS (SSL-VPN, fnbamd, and FSSO components), FortiGate, and FortiSandbox. The most severe issues could enable unauthenticated exploitation paths that result in command/code execution, authentication bypass, firewall policy evasion, sensitive information exposure, or denial-of-service. If exploited in the context of privileged services or administrative workflows, attackers may be able to alter security configurations, create or abuse administrative accounts, and gain sustained control of perimeter devices. FortiSandbox is impacted by CVE-2025-52436 affecting 5.0.0–5.0.1 and 4.4.0–4.4.7, with vendor fixes available in later releases (or migration to fixed trains where required). FortiOS is affected across multiple branches, with fixes generally delivered via point upgrades (for example 7.6.x and 7.4.x patched releases) or requiring migration from unsupported trains. Organizations running exposed SSL-VPN services or heavily relied-on perimeter enforcement devices face increased risk where vulnerable versions remain deployed.

CVE
CVE-2025-52436
CVE-2025-68686
CVE-2025-55018
CVE-2026-22153
CVE-2025-64157
CVE-2025-62439

Targeting / Delivery Mechanism
Attackers may target internet-facing SSL-VPN or web-exposed services using crafted HTTP requests and headers. Some issues require authenticated administrative access (configuration-driven abuse), while at least one scenario assumes prior filesystem-level compromise before the technique becomes useful. LDAP-dependent deployments may be exposed under specific directory configurations.

Execution Technique
Techniques include request smuggling to pass unlogged traffic through policy enforcement, authentication bypass in fnbamd under specific LDAP configurations, information exposure in SSL-VPN post-exploit scenarios, and crafted web requests against FortiSandbox input handling. A configuration-based format-string weakness may allow authenticated administrators to execute unauthorized code/commands.

Persistence / Deployment
If perimeter appliances are compromised, attackers can persist by creating admin users, weakening policies, and modifying authentication or inspection behavior to support repeated access and lateral movement.