OTPulse

Workflow session email approval process bypass

MonitorCVSS 4.7FG-IR-26-171Sep 8, 2026
Fortinet
IT in OT - Fortinet products are commonly deployed at IT/OT network boundaries
Attack path
Attack VectorNetwork
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary

Fortinet FortiManager contains a flaw in the workflow session email approval process that allows an attacker with high-level administrative credentials to bypass email approval verification. This enables an attacker to approve operational changes and deploy configurations without proper authorization validation.

What this means
What could happen
An attacker with high-level administrative privileges could bypass email approval requirements in the workflow process, allowing them to approve operational changes without proper authorization verification and potentially deploy unapproved configurations.
Who's at risk
FortiManager administrators and operators managing network infrastructure deployments. This affects organizations using FortiManager for centralized management of Fortinet security appliances (FortiGate firewalls, FortiAPs, etc.) across multiple locations. Security teams relying on workflow email approvals for change control will be impacted.
How it could be exploited
An attacker with admin or equivalent privileges on FortiManager can manipulate workflow session email approval checks to approve changes without sending or validating email confirmations. This allows unauthorized operational changes to be deployed without the required approval chain verification.
Prerequisites
  • High-level administrative credentials on FortiManager (admin or equivalent role)
  • Access to workflow session management functionality
  • Target running vulnerable FortiManager or FortiManager Cloud version
Requires high administrative privilegesIntegrity bypass of approval processLow EPSS score (actively exploited: no)Affects change management controls
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (6)
6 with fix
ProductAffected VersionsFix Status
FortiManager7.6.0 - 7.6.47.6.5+
FortiManager7.4.0 - 7.4.107.4.11+
FortiManager7.2 all versionsMigrate to fixed release
FortiManager Cloud7.6.2 - 7.6.47.6.5+
FortiManager Cloud7.2 all versionsMigrate to fixed release
FortiManager Cloud7.4.1 - 7.4.107.6.5
Remediation & Mitigation
0/5
Do now
0/1
HARDENINGReview and audit all workflow approvals and deployed configurations for unauthorized changes made by high-privilege accounts
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

FortiManager
HOTFIXUpgrade FortiManager to version 7.6.5 or later if running 7.6.0-7.6.4
HOTFIXUpgrade FortiManager to version 7.4.11 or later if running 7.4.0-7.4.10
HOTFIXMigrate FortiManager 7.2 to a supported fixed release (7.4.11+ or 7.6.5+)
Long-term hardening
0/1
FortiManager
HARDENINGRestrict administrative access to FortiManager to only personnel with legitimate operational need and implement role-based access controls to limit approval authority
View full vendor advisory
API: /api/v1/advisories/9908e2de-440b-44eb-832d-cbd118d81440

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.