Lack of TLS Certificate Validation during initial SSO Authentication

An attacker on the network path between your FortiAnalyzer or FortiManager and FortiCloud could intercept and modify the initial SSO authentication, potentially gaining administrator access to the management system.

Organizations running FortiAnalyzer or FortiManager (versions 6.4 through 7.6.4) should care. These are centralized management and analytics systems often controlling firewall and threat prevention for multiple network segments. A compromise could allow an attacker to bypass security policies, access logs, or alter forwarding rules across your entire infrastructure.

An attacker must position themselves on the network path (e.g., via ARP spoofing, DNS poisoning, or BGP hijacking) between the FortiAnalyzer/FortiManager and FortiCloud during initial device registration. They present a forged TLS certificate that the device fails to validate, allowing them to intercept the SSO authentication handshake and capture or modify credentials before they reach FortiCloud.