CVE-2026-22153: FortiOS LDAP Authentication Bypass in Agentless VPN & FSSO

HERMES

HERMES THREAT SCORE & LDAP PERIMETER BYPASS RISK

Target: Fortinet FortiOS LDAP Auth Engine (Agentless VPN / FSSO)

Confidence: 97%

85 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 14 / 20

Weaponization 16 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 18 / 20

Exploit Maturity 15 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

Hermes rates CVE-2026-22153 at HTS 85 (High). Bypassing LDAP directory controls allows unauthenticated external threat actors to gain authorized network access or establish VPN sessions without valid domain credentials when directory servers accept specific bind modes.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-22153: FortiOS LDAP Authentication Bypass in Agentless VPN & FSSOVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTFortinet FortiOS Gateway

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Fortinet FortiOS Gateway documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Unauthenticated LDAP Authentication Bypass

CVSS v3.1: 8.1 High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) / CWE-305: Authentication Bypass by Primary Weakness.
Disclosed by Fortinet PSIRT. Under specific remote LDAP server configurations (such as anonymous bind acceptance or blank password handling), an unauthenticated attacker connecting to Agentless VPN or FSSO-protected portals can bypass identity verification and gain network access. Addressed in FortiOS 7.6.5.

Executive Summary

Fortinet resolved CVE-2026-22153, an authentication bypass flaw impacting the LDAP client validation engine in FortiOS 7.6.0 through 7.6.4.

When enterprise organizations configure FortiOS to authenticate VPN clients or Web Portal sessions against remote LDAP directory servers (such as Microsoft Active Directory or OpenLDAP), edge cases in return-code processing treated unauthenticated bind acknowledgments as successful validation, opening corporate networks to unauthorized external ingress.

---

1. Metadata & Attack Surface

Metric	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-22153	Standardized vulnerability identifier
Vendor / Software	Fortinet / FortiOS 7.6	Enterprise firewall & VPN gateway
Affected Releases	FortiOS 7.6.0 through 7.6.4	7.6 release train
Fixed Release	FortiOS 7.6.5	Vendor security release
Associated CWE	CWE-305: Authentication Bypass by Primary Weakness	Identity verification failure
Exposure Vector	Network (AV:N) / Agentless VPN & FSSO Web Portals	Remote unauthenticated attacker

---

2. Technical Root Cause Analysis

The flaw stems from flawed interpretation of LDAP server responses within the FortiOS authentication daemon (authd).

CVE-2026-22153 LDAP Authentication Bypass Sequence:

  ┌────────────────────────────────────────────────────────┐
  │ Unauthenticated Attacker                               │
  └───────────────────────────┬────────────────────────────┘
                              │
                              │ Authentication request with blank password or
                              │ crafted LDAP attributes
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ FortiOS authd Engine                                   │
  │ - Forwards bind request to remote LDAP server          │
  └───────────────────────────┬────────────────────────────┘
                              │
                              │ LDAP response: Success on Anonymous Bind / Partial
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ Flawed Return Code Handling                            │
  │ - Treats non-error code as positive password match     │
  │ - Grants authorized VPN session or FSSO profile        │
  └────────────────────────────────────────────────────────┘

When the upstream LDAP directory does not reject anonymous binds or returns partial success states for unrecognized DNs, FortiOS interpreted the absence of an explicit LDAP_INVALID_CREDENTIALS code as successful authentication.

---

3. Remediation & Hardening Playbook

1. Apply Firmware Upgrade:
   Upgrade FortiOS 7.6 appliances to 7.6.5 or higher.
2. Harden LDAP Server Configuration:
   Ensure all corporate LDAP and Active Directory servers explicitly forbid anonymous binds:

   config user ldap
       edit "Corp-AD"
           set secure ldaps
           set port 636
           set bind-type regular
       next
   end

3. Audit Active VPN Sessions:
   Review current active VPN sessions for logins with unmapped or empty username profiles:

   diagnose vpn ssl list