FortiOS Authentication Bypass Vulnerability Allows Attackers to Bypass LDAP Login

Fortinet just dropped a bombshell security alert about a nasty bug in its FortiOS firewall software. Tracked as CVE-2026-22153, this high-severity vulnerability lets attackers dodge LDAP authentication entirely.

That means hackers could sneak into your network without a valid username or password. Ouch.

At the heart of the problem is the fnbamd daemon a key FortiOS component that handles user logins for things like Agentless VPNs and Fortinet Single Sign-On (FSSO).

When your firewall talks to an LDAP server (think Microsoft Active Directory), it verifies credentials to enforce access rules.

But here’s the glitch: if the LDAP server allows “unauthenticated binds” (anonymous connections), the firewall gets fooled. It green-lights the login anyway, bypassing all checks.

This falls under CWE-305, an “Authentication Bypass by Primary Weakness.” Picture this: an attacker sends a crafty request to your FortiGate device. The permissive LDAP server responds without demanding real creds, and boom

The firewall thinks it’s legit. No password? No problem for the hacker. They gain unauthorized entry, potentially raiding sensitive data or pivoting deeper into your network.

Fortinet rates it 7.5 on the CVSSv3 scale high risk, low complexity. No fancy exploits needed; it’s network-accessible and needs no privileges. Affected versions? FortiOS 7.6.x builds before 7.6.5.

Field	Value
CVE ID	CVE-2026-22153
Severity	High
CVSSv3 Score	7.5
CWE	CWE-305
Affected Versions	FortiOS 7.6.x (<7.6.5)
Component	fnbamd daemon
Vector	Network (remote)
Requirements	LDAP unauthenticated binds enabled

Check Fortinet’s advisory here for the full rundown.

Exploitation isn’t theoretical. Security teams worry this could chain with other FortiOS flaws for full compromise.

Fortinet urges immediate upgrades to FortiOS 7.6.5 or later. Can’t patch right away? Here’s a solid workaround: Disable unauthenticated binds on your LDAP server.

For Windows Server 2019+, fire up PowerShell as admin and run:

Set-ItemProperty -Path "CN={LDAPDC},CN=Sites,CN=Configuration,DC=yourdomain,DC=com" -Name "DenyUnauthenticatedBind" -Value 1

Restart the domain controller afterward. This slams the door on anonymous LDAP connections, neutering the bypass.

Why does this matter? FortiGate firewalls guard millions of enterprise networks. A slip-up here exposes VPN tunnels and SSO policies to the wild.

Fortinet patched it quietly no public exploits yet, but threat actors like Lazarus Group love Fortinet holes.

Stay vigilant: Scan your setups with tools like Nessus or OpenVAS for vulnerable FortiOS versions. Enable logging on fnbamd for anomaly hunting. And always segment LDAP from the internet.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.