Authentication Lockout Bypass via Race Condition

🗓️ 10 Mar 2026 00:00:00Reported by FortiGuard LabsType

Auth lockout bypass via race condition in FortiManager and FortiAnalyzer allowing bruteforce.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-22629	10 Mar 202616:44	–	attackerkb
BDU FSTEC	The vulnerability of the Fortinet FortiManager software, which is used for centralized device management, and the Fortinet FortiAnalyzer software, which is used for event monitoring and analysis, stems from insufficient restrictions on authentication attempts. This allows a malicious actor to circumvent existing security restrictions.	17 Mar 202600:00	–	bdu_fstec
CNNVD	Fortinet多款产品安全漏洞	10 Mar 202600:00	–	cnnvd
CVE	CVE-2026-22629	10 Mar 202616:44	–	cve
Cvelist	CVE-2026-22629	10 Mar 202616:44	–	cvelist
EUVD	EUVD-2026-10517	10 Mar 202618:31	–	euvd
EUVD	EUVD-2026-10518	10 Mar 202618:31	–	euvd
Tenable Nessus	Fortinet FortiAnalyzer Authentication Lockout Bypass via Race Condition (FG-IR-26-079)	10 Mar 202600:00	–	nessus
Tenable Nessus	Fortinet FortiManager Authentication Lockout Bypass via Race Condition (FG-IR-26-079)	10 Mar 202600:00	–	nessus
NCSC	Vulnerabilities fixed in Fortinet FortiManager and FortiAnalyzer	11 Mar 202609:19	–	ncsc