CVE-2026-22629: Authentication Lockout Bypass via Race Condition
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiManager and FortiAnalyzer may allow an attacker to bypass bruteforce protections via exploitation of race conditions.
Other sources
An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4 all versions, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4 all versions, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4 all versions, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions, FortiManager Cloud 6.4 all versions may allow an attacker to bypass bruteforce protections via exploitation of race conditions. The latter raises the complexity of practical exploitation.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22629?
CVE-2026-22629 is classified as a medium severity vulnerability due to its potential to bypass authentication lockouts.
What versions are affected by CVE-2026-22629?
CVE-2026-22629 affects FortiManager and FortiAnalyzer versions from 6.4 up to 7.6.4.
How do I fix CVE-2026-22629?
To fix CVE-2026-22629, upgrade FortiManager or FortiAnalyzer to version 7.6.5 or higher.
What products are impacted by CVE-2026-22629?
The impacted products include FortiManager, FortiAnalyzer, FortiManager Cloud, and FortiAnalyzer Cloud.
Can CVE-2026-22629 be exploited remotely?
Yes, CVE-2026-22629 can be exploited remotely by attackers to bypass authentication protection mechanisms.