FortiPAM & FortiSwitch Manager Flaw Allows Attackers to Bypass Authentication

Fortinet has disclosed a critical security vulnerability affecting FortiPAM and FortiSwitch Manager that could allow attackers to bypass authentication through brute-force attacks. The flaw, tracked as CVE-2025-49201, was discovered by Gwendal Guégniaud of the Fortinet Product Security team and published on 14 October 2025, according to Fortinet Product Security team.

It is a weak authentication weakness (CWE-1390) with a CVSS v3.1 score of 7.4, and the attack vector is network-based, requiring no user interaction or prior privileges. FortiPAM versions 1.0 through 1.5.0 are affected, with legacy 1.0–1.3 and 1.4.0–1.4.2 needing migration to fixed releases or upgrading to 1.4.3 or higher, while 1.5.0 should move to 1.5.1 or above; FortiSwitch Manager versions 7.2.0 through 7.2.4 require upgrading to 7.2.5.

Notably, FortiPAM 1.6 and 1.7, and FortiSwitch Manager 7.0 are not affected and require no action. Organisations with internet-facing deployments are advised to patch promptly, verify current versions, review access logs for suspicious authentication attempts, and consider additional security controls such as IP whitelisting or multi-factor authentication where possible.