Fortinet Advisory Details RADIUS Protocol Flaw Enabling Server Impersonation

Fortinet has issued a security advisory, FG-IR-26-247, highlighting a critical vulnerability within the RADIUS protocol implementation across several of its products. The flaw, classified as Improper Certificate Validation (CWE-295), carries a CVSSv3 score of 7.5, indicating a high severity level.

This vulnerability could allow a sophisticated Man-in-the-Middle (MITM) attacker to impersonate a legitimate RADIUS server. By deploying a rogue RADIUS server, an attacker could intercept authentication requests, potentially leading to unauthorized access to sensitive network resources or user credentials. The attack vector relies on the failure of the affected systems to properly validate the certificates presented by the RADIUS server.

The affected products include FortiSASE Sovereign, FortiManager, Fortianalyzer, FortiManager Cloud, and FortiAnalyzer Cloud. A comprehensive list of vulnerable versions has been provided, spanning numerous releases of FortiAnalyzer and FortiAnalyzer Cloud, from older versions like 7.2.0 up to the latest 8.0.1 releases. This broad range of affected versions suggests a widespread potential impact across organizations utilizing these Fortinet solutions for network access control and security management.

While the advisory does not explicitly mention specific exploitation in the wild, the nature of a MITM attack targeting authentication protocols makes it a prime candidate for exploitation by advanced persistent threats (APTs) or financially motivated cybercriminals. The ability to impersonate a RADIUS server could be a stepping stone to deeper network compromise, data theft, or the deployment of further malicious payloads.

Fortinet's advisory indicates that the vulnerability was discovered internally by Loic Pantano of the Fortinet Product Security team, with assistance from an AI model named Claude Mythos. This internal discovery and reporting process is crucial for proactive security management and timely remediation.

As of the advisory's publication date, no specific workarounds or immediate mitigations beyond patching are detailed. Users are strongly advised to consult the full advisory and apply the necessary updates as soon as possible to protect their environments from potential exploitation. The advisory itself is marked as 'Final' and was initially published on November 10, 2026.

This vulnerability underscores the ongoing importance of robust certificate validation mechanisms in network infrastructure. As organizations increasingly rely on centralized authentication systems like RADIUS, flaws in their implementation can have significant security repercussions. Proper validation of server identities is a fundamental security control that prevents impersonation and ensures the integrity of network access.