Authentication bypass in Fortinet FortiOS with certain LDAP setups

Fortinet has published an advisory for a high-severity vulnerability in FortiOS, CVE-2026-22153. The flaw arises when the firewall interacts with an LDAP server that permits unauthenticated binds, and under specific configurations it can let an attacker bypass the LDAP authentication used for agentless VPN and for Fortinet Single Sign-On policies. The result can be unauthorised network access without valid credentials. Patches and workarounds are available. There is no known public exploit or active exploitation at this point.

What this means for your organisation

This is a weakness in the front door, where the firewall decides who gets onto the network. Note that it only bites under particular configurations, so the first question is whether your LDAP server permits anonymous binds at all. That is a configuration choice many organisations have never consciously made.

Berigo recommends

• Check whether your LDAP server permits unauthenticated binds, and disable it if nothing depends on it.
• Deploy Fortinet's fix, or the published workarounds until an update is possible.
• Review the configuration of agentless VPN and FSSO policies and confirm which authentication source they actually use.
• Look for VPN logins without a matching successful authentication in your directory service logs.

Source

• fortiguard.fortinet.com