CVE-2026-22153: LDAP authentication bypass in Agentless VPN and FSSO
Published Feb 10, 2026
·Updated
An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is configured in a specific way.
Affected Software
1 affected component
Fortinet FortiOS>=7.6.0<7.6.5
Remediation
Information
Upgrade to FortiOS version 8.0.0 or above
Upgrade to FortiOS version 7.6.5 or above
Event History
Feb 10, 2026
CVE Published
via MITRE·03:39 PM
Data Sourced
via MITRE·03:39 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-22153?
CVE-2026-22153 has a critical severity rating due to the potential for unauthenticated remote access.
2
How do I fix CVE-2026-22153?
To fix CVE-2026-22153, upgrade FortiOS to version 7.6.5 or later.
3
What affected software versions are vulnerable to CVE-2026-22153?
FortiOS versions from 7.6.0 to 7.6.4 are vulnerable to CVE-2026-22153.
4
Can I mitigate CVE-2026-22153 without upgrading?
No effective mitigation techniques are available other than upgrading to a secure version for CVE-2026-22153.
5
What type of attack does CVE-2026-22153 allow?
CVE-2026-22153 allows an unauthenticated attacker to bypass LDAP authentication in specific configurations.