CVE-2026-22629: Fortinet FortiAnalyzer, логическа грешка

Описание

Оригинално описание

An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4 all versions, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4 all versions, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4 all versions, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions, FortiManager Cloud 6.4 all versions may allow an attacker to bypass bruteforce protections via exploitation of race conditions. The latter raises the complexity of practical exploitation.

Засегнати продукти

• Fortinet FortiAnalyzer: 7.6.0 до 7.6.4; 7.4.0 до 7.4.10; 7.2.0 до 7.2.12; 7.0.0 до 7.0.16; 6.4.0 до 6.4.15
• Fortinet FortiManager Cloud: 7.6.2 до 7.6.3; 7.4.1 до 7.4.7; 7.2.1 до 7.2.10; 7.0.1 до 7.0.14; 6.4.1 до 6.4.7
• Fortinet FortiAnalyzer Cloud: 7.6.2; 7.4.1 до 7.4.7; 7.2.1 до 7.2.10; 7.0.1 до 7.0.14; 6.4.1 до 6.4.7
• Fortinet FortiManager: 7.6.0 до 7.6.4; 7.4.0 до 7.4.10; 7.2.0 до 7.2.12; 7.0.0 до 7.0.16; 6.4.0 до 6.4.15

Вид слабост

• CWE-307 Неправилно ограничаване на прекомерни опити за автентикация

История

Други уязвимости в Fortinet FortiAnalyzer

• 7.9CVE-2025-46773
• 5.9CVE-2026-23706
• 6.5CVE-2026-23707
• 6.5CVE-2026-23705
• 5.3CVE-2026-106171

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-22629
• https://nvd.nist.gov/vuln/detail/CVE-2026-22629
• https://fortiguard.fortinet.com/psirt/FG-IR-26-079