CVE-2026-22629

State: Published
Severity: 3.4 Low
Published: Mar 10, 2026
Updated: May 13, 2026
Reserved: Jan 8, 2026

Description

An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4 all versions, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4 all versions, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4 all versions, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions, FortiManager Cloud 6.4 all versions may allow an attacker to bypass bruteforce protections via exploitation of race conditions. The latter raises the complexity of practical exploitation.

Scores

CVSS	Score	Vector	Source
3.1	3.4 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	fortinet

Weaknesses

CWE-307 Improper access control

Affected Products

Product	Versions
FortiAnalyzerFortinet	7.6.0 through 7.6.4Affected 7.4.0 through 7.4.10Affected 7.2.0 through 7.2.12Affected 7.0.0 through 7.0.16Affected 6.4.0 through 6.4.15Affected
FortiManager CloudFortinet	7.6.2 through 7.6.3Affected 7.4.1 through 7.4.7Affected 7.2.1 through 7.2.10Affected 7.0.1 through 7.0.14Affected 6.4.1 through 6.4.7Affected
FortiAnalyzer CloudFortinet	7.6.2Affected 7.4.1 through 7.4.7Affected 7.2.1 through 7.2.10Affected 7.0.1 through 7.0.14Affected 6.4.1 through 6.4.7Affected
FortiManagerFortinet	7.6.0 through 7.6.4Affected 7.4.0 through 7.4.10Affected 7.2.0 through 7.2.12Affected 7.0.0 through 7.0.16Affected 6.4.0 through 6.4.15Affected

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-079

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.