Introduction
A weak authentication flaw in FortiPAM and FortiSwitchManager lets attackers bypass authentication and execute unauthorized commands on critical Fortinet infrastructure. The affected products are privileged access management and network management systems that are widely deployed in enterprise environments, so the flaw leaves sensitive assets open to remote compromise.
Fortinet is a leading global cybersecurity vendor whose products include firewalls, privileged access management, and network infrastructure. Thousands of organizations worldwide use them to secure critical assets and manage privileged access. Because these systems sit at the center of enterprise security architectures, a vulnerability in them can have significant impact.
Technical Information
CVE-2025-49201 is a weak authentication vulnerability classified under CWE-1390. It affects Fortinet FortiPAM and FortiSwitchManager. A remote attacker can bypass authentication controls by sending specially crafted HTTP requests to the affected services, and successful exploitation lets the attacker execute unauthorized code or commands with the privileges of the application.
The root cause is that the authentication process does not sufficiently validate user identity. An attacker triggers the flaw by manipulating HTTP requests. No further technical details, vulnerable code snippets, or exploitation flows are publicly available. The attack vector is remote, and the attacker does not need to authenticate first.
Affected Systems and Versions
- FortiPAM: Versions 1.0.0 through 1.0.3, 1.1.0 through 1.1.2, 1.2.0, 1.3.0 through 1.3.1, 1.4.0 through 1.4.2, and 1.5.0
- FortiSwitchManager: Versions 7.2.0 through 7.2.4
All configurations of these versions are vulnerable unless the vendor specifies otherwise.
Vendor Security History
Fortinet has previously fixed authentication-related vulnerabilities in several products, including FortiManager, FortiOS, FortiProxy, and FortiWeb. Some of those issues, such as command injection and authentication bypass, have been exploited in the wild. Authentication flaws keep recurring across the Fortinet product line, which points to ongoing difficulty with secure implementation. Fortinet generally publishes advisories and patches promptly, but organizations should stay alert and monitor for new disclosures.
