{"id":"CVE-2026-22153","title":"An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remo…","summary":"An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remo…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-305"],"vendor":"Fortinet","product":"FortiOS","affected":["FortiOS >= 7.6.0 <= 7.6.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-02-11T04:56:21.036753Z"},"published":"2026-02-10","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:42:05.697Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-22153","references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-1052","label":"https://fortiguard.fortinet.com/psirt/FG-IR-25-1052"}],"tags":["cve.org"],"epss":0.00748,"epssPercentile":0.5514,"ingestedAt":"2026-11-06T15:54:03.988Z","slug":"CVE-2026-22153","body":"## Overview\n\nAn Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is configured in a specific way.\n\n## Affected\n\n- `FortiOS >= 7.6.0 <= 7.6.4`\n\n## Remediation\n\nUpgrade to FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.5 or above","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}