FortiPAM & FortiSwitch Manager Flaw Allows Attackers to Bypass Authentication
Fortinet has disclosed a critical security vulnerability affecting FortiPAM and FortiSwitchManager products. This vulnerability could allow attackers to bypass authentication mechanisms through brute-force attacks.
Fortinet has disclosed a critical security vulnerability affecting FortiPAM and FortiSwitchManager products. This vulnerability could allow attackers to bypass authentication mechanisms through brute-force attacks.
Weak Authentication Vulnerability Enables Brute-Force Attacks
The vulnerability, identified as CVE-2025-49201, was discovered by Gwendal Guégniaud of the Fortinet Product Security team and made public on October 14, 2025. It arises from a weak authentication issue in the FortiPAM and FortiSwitch Manager WAD/GUI components, classified under CWE-1390.
This flaw allows threat actors to circumvent the authentication process, facilitating brute-force attacks against affected systems. With a CVSS v3.1 score of 7.4, the vulnerability is rated high severity, posing a significant risk to organizations using susceptible versions.
The attack vector is network-based, requiring no user interaction or prior privileges, thus posing a considerable threat to internet-facing deployments. Despite the high attack complexity, successful exploitation could result in unauthorized access, enabling attackers to execute code or commands on compromised systems.
The vulnerability impacts several versions of FortiPAM, including versions 1.0 through 1.5.0, with varying severity levels. FortiPAM versions 1.0, 1.1, 1.2, and 1.3 require migration to fixed releases, as patches are unavailable for these legacy versions. Organizations using FortiPAM 1.4.0 through 1.4.2 should upgrade to version 1.4.3 or higher, while those on FortiPAM 1.5.0 need to upgrade to version 1.5.1 or above.
FortiSwitchManager versions 7.2.0 through 7.2.4 are also affected, with version 7.2.5 released as the patched solution. Notably, FortiPAM versions 1.6 and 1.7 and FortiSwitchManager 7.0 are unaffected and require no action.
Security teams managing Fortinet infrastructure should prioritize patching based on their deployment configurations. Organizations with internet-facing FortiPAM or FortiSwitchManager installations face heightened risk and should expedite remediation.
Administrators should verify current software versions, review access logs for suspicious authentication attempts, and implement additional security controls such as IP whitelisting or multi-factor authentication where feasible.
Fortinet has disclosed a critical security vulnerability affecting FortiPAM and FortiSwitchManager products.
CVE ID CVSS Score Attack Vector Attack Complexity
CVE-2025-49201 7.4 (High) Network High
Product Affected Versions Solution
FortiPAM 1.5 1.5.0 Upgrade to 1.5.1 or above
FortiPAM 1.4 1.4.0 through 1.4.2 Upgrade to 1.4.3 or above
FortiPAM 1.3 All versions Migrate to fixed release
FortiPAM 1.2 All versions Migrate to fixed release
FortiPAM 1.1 All versions Migrate to fixed release
FortiPAM 1.0 All versions Migrate to fixed release
FortiSwitchManager 7.2 7.2.0 through 7.2.4 Upgrade to 7.2.5 or above
Organizations with unsupported versions requiring migration should develop transition plans to move to supported releases promptly. Regular monitoring of authentication logs for unusual brute-force patterns can help detect potential exploitation attempts while patches are being deployed.
Based on reporting by GBHackers.