CVE-2022-22300: Fortinet Fortianalyzer

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2, FortiManager version 5.6.0 through 5.6.11, FortiManager version 6.0.0 through 6.0.11, FortiManager version 6.2.0 through 6.2.9, FortiManager version 6.4.0 through 6.4.7, FortiManager version 7.0.0 through 7.0.2 allows attacker to bypass the device policy and force the password-change action for its user.

Affected products

• Fortinet Fortianalyzer: from 5.6.0, up to and including 5.6.11; from 6.0.0, up to and including 6.0.11; from 6.2.0, up to and including 6.2.9; from 6.4.0, up to and including 6.4.7; from 7.0.0, before 7.0.3 (fixed in 7.0.3)
• Fortinet FortiManager: from 5.6.0, up to and including 5.6.11; from 6.0.0, up to and including 6.0.11; from 6.2.0, up to and including 6.2.9; from 6.4.0, up to and including 6.4.7; from 7.0.0, before 7.0.3 (fixed in 7.0.3)

Published 2022-03-01. Last modified 2026-06-17.