CVE-2021-26107: Fortinet FortiManager

Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days.

An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager.

Affected products

• Fortinet FortiManager: version 6.4.4 only; version 6.4.5 only

Published 2021-11-02. Last modified 2026-06-17.