FortiManager CVE-2026-70468

Exploitation requires network-level reachability to the FortiManager management interface - typically TCP/443 (HTTPS REST API and GUI) or TCP/541 (FGFM device management protocol). The CVSS PR:N metric confirms no authentication credential is required. The AC:H metric indicates at least one specific condition must be satisfied to trigger the bypass - the precise triggering mechanism is not disclosed in available source data because the CVE description contains an unfilled template placeholder ('via <insert attack vector here>'), leaving the exact alternate path or channel unconfirmed. Exploitation is limited to the FortiManager management plane and does not directly compromise managed downstream FortiGate devices without further attacker-initiated action. Both on-premises FortiManager deployments and FortiManager Cloud tenants within the stated version ranges are within scope, meaning cloud-hosted tenants are not inherently safer than self-managed deployments.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1, indicating a network-accessible, unauthenticated vulnerability with high attack complexity and full impact across confidentiality, integrity, and availability. The AC:H qualifier signals that exploitation requires a specific but attainable condition - likely a timing window, a particular protocol negotiation sequence, or a specific feature state - which moderates immediate mass-exploitation risk but does not eliminate targeted threat actor interest. No EPSS score was provided in source intelligence, precluding quantified exploitation probability. The absence of a CISA KEV listing and no confirmed POC suggest exploitation has not been observed at scale; however, Fortinet management platforms have been aggressively targeted by sophisticated actors, with CVE-2024-47575 (FortiJump) serving as a directly comparable precedent where FortiManager was compromised at scale in active campaigns. The scope-unchanged metric (S:U) limits direct blast radius to the FortiManager system itself, but in practice, compromise of the management plane delivers indirect control over every managed downstream device - meaning even a mid-sized municipal IT team in mielec operating a Fortinet estate should treat this as urgent patching priority rather than deferring behind the AC:H signal. The combination of unauthenticated network access and high-value target class makes this a realistic priority even without confirmed exploitation evidence.

An attacker with network reachability to the FortiManager management interface sends a crafted request targeting an alternate endpoint or protocol channel that bypasses the primary authentication middleware, obtaining administrative API access without valid credentials. From that position, the attacker reads device configurations and harvests credentials for all managed FortiGate firewalls, then deploys malicious policy changes or backdoor rules across the entire managed estate. No confirmed proof-of-concept is publicly available at time of analysis, but the attack pattern is consistent with techniques demonstrated in prior FortiManager exploitation campaigns.