CVE-2023-22642: Fortinet Fortianalyzer

High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days.

An improper certificate validation vulnerability [CWE-295] in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the remote FortiGuard server hosting outbreakalert ressources.

Affected products

• Fortinet Fortianalyzer: from 6.4.8, before 6.4.11 (fixed in 6.4.11); from 7.0.0, before 7.0.6 (fixed in 7.0.6); from 7.2.0, before 7.2.2 (fixed in 7.2.2)
• Fortinet FortiManager: from 6.4.8, before 6.4.11 (fixed in 6.4.11); from 7.0.0, before 7.0.6 (fixed in 7.0.6); from 7.2.0, before 7.2.2 (fixed in 7.2.2)

Published 2023-04-11. Last modified 2026-06-17.