A critical weak authentication flaw in Fortinet FortiPAM and FortiSwitchManager permits remote code execution, posing a significant risk to organizational infrastructure.

This vulnerability is a weak authentication issue that allows an unauthenticated remote attacker to execute arbitrary code or commands by sending specially crafted HTTP requests to the target system.

Successful exploitation of this vulnerability leads to full system compromise, as it allows for unauthorized code execution with high impact on confidentiality, integrity, and availability. With a CVSS score of 8.1, this represents a high-severity threat that could lead to unauthorized administrative access, data exfiltration, or complete system takeover by external actors.

Immediate Action: Upgrade FortiPAM to version 1.6.0, 1.5.1, or 1.4.3, and upgrade FortiSwitchManager to version 7.2.5 or above.

Proactive Monitoring: Review web server and application access logs for suspicious HTTP requests, particularly those containing unusual payloads or attempts to access administrative endpoints.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to inspect and filter incoming HTTP requests to the affected management interfaces until patches can be applied.

Public Exploit Available: No

Given the potential for remote code execution and the exposure of management interfaces, organizations should prioritize these updates immediately. Apply the provided vendor patches during the next maintenance window to eliminate the underlying authentication weakness and prevent potential exploitation.