CVE-2022-27490: Fortinet Fortianalyzer

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.x, 6.0.x allows an attacker which has obtained access to a restricted administrative account to obtain sensitive information via `diagnose debug` commands.

Affected products

• Fortinet Fortianalyzer: from 5.6.0, up to and including 5.6.11; from 6.0.0, up to and including 6.0.4
• Fortinet FortiManager: from 5.6.0, up to and including 5.6.11; from 6.0.0, up to and including 6.0.4
• Fortinet Fortiportal: from 4.1.0, up to and including 4.1.2; from 4.2.0, up to and including 4.2.2; from 5.0.0, up to and including 5.0.3; from 5.1.0, up to and including 5.1.2; from 5.2.0, up to and including 5.2.6; from 5.3.0, up to and including 5.3.8; …
• Fortinet Fortiswitch: from 6.0.0, up to and including 6.0.7; from 6.2.0, up to and including 6.2.7; from 6.4.0, up to and including 6.4.10; from 7.0.0, up to and including 7.0.4

Published 2023-03-07. Last modified 2026-06-17.