CVE-2023-36554 is a high severity improper access control flaw (CVSS 8.1) in Fortinet FortiManager, tied to the FortiWLM MEA component. Fortinet says upgrading to 7.4.1, 7.2.4, 7.0.11 or 6.4.14 or later fixes it, and that 6.2 users must migrate to a fixed release.
What's affected
The NVD record and the Fortinet advisory (FG-IR-23-103) agree on the version ranges:
- 7.4: 7.4.0 is affected. Fixed in 7.4.1 or later.
- 7.2: 7.2.0 through 7.2.3 are affected. Fixed in 7.2.4 or later.
- 7.0: 7.0.0 through 7.0.10 are affected. Fixed in 7.0.11 or later.
- 6.4: 6.4.0 through 6.4.13 are affected. Fixed in 6.4.14 or later.
- 6.2: all versions are affected. Migrate to a fixed release.
There is one difference in framing. The NVD text says FortiManager is affected. The Fortinet advisory ties the flaw to FortiWLM MEA running on FortiManager, and says that component is not installed by default. Both give 8.1 as the base score, and the advisory adds a temporal score of 7.7. The advisory describes the attacker as unauthenticated and says the issue is not known to be exploited. The record's CISA KEV flag is false.
How to check if you're exposed
On the FortiManager CLI, the status command shows the firmware version and build:
get system status
Compare the version with the table above. If you are in an affected range, check whether the FortiWLM MEA component is present on the device. The advisory is the place to confirm how to do that for your release, since the component is optional and I have not verified a version-specific command.
What to do now
- Inventory every FortiManager you run, including lab and disaster recovery units.
- Upgrade to a fixed release for your branch: 7.4.1, 7.2.4, 7.0.11 or 6.4.14 or later.
- If you run 6.2, plan a migration. Fortinet lists every 6.2 version as affected and gives no 6.2 fix.
- Where you cannot upgrade immediately, follow the workaround in the advisory: FortiWLM MEA is not installed by default, and disabling it mitigates the issue.
- Restrict network access to the management interface to trusted admin networks.
- Read FG-IR-23-103 in full for any later revisions, since Fortinet updated it in January 2025.
Why it matters
The weakness class is CWE-284, improper access control. In plain terms, a function that should only run for a trusted caller can be reached by someone who should not be able to. Here the advisory says specially crafted HTTP requests could lead to unauthorized code or commands, tied to the backup and restore features of the component.
Management planes are valuable targets. A device like FortiManager holds configuration and credentials for many other devices, so a flaw on it has a wide blast radius even when the CVSS attack complexity is rated high, as it is here. Treat the patch as a normal priority upgrade and keep the interface off untrusted networks.
Safeguard can help with the inventory side of this work. The free in-browser dependency scan at gold.safeguard.sh/scan checks the packages in a manifest against known CVEs, and the Gold directory keeps a page per CVE and per weakness class so you can see related issues in one place. Reachability analysis then helps you separate a package that is merely present from one your code actually calls.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I have to upgrade if I never installed FortiWLM MEA?
The advisory says the component is not installed by default, and that disabling it mitigates the flaw. You should still plan the upgrade, but your exposure is lower if the component is absent. Confirm in the advisory for your release.
Has this been exploited?
The Fortinet advisory says it is not known to be exploited, and the CISA KEV flag in the record is false. That can change, so check the advisory for updates.
Sources
Last reviewed: 19 October 2026.
