CVE-2023-46717 is a high severity (CVSS 7.5) improper authentication flaw in FortiOS when configured with FortiAuthenticator in high availability. A read-only user may gain read-write access through successive login attempts. Upgrade to 7.4.2, 7.2.8 or 7.0.13 or later, or disable FortiToken Mobile push.
What's affected
Fortinet advisory FG-IR-23-424 lists FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 as affected. FortiOS 6.4 is not affected. Fixes are 7.4.2, 7.2.8 and 7.0.13 or later. The record words the ranges as 7.4.1 and below, 7.2.6 and below, and 7.0.12 and below, so the advisory's 7.2.7 upper bound is wider.
Fortinet rates it Medium with a base score of 7.5 and temporal 6.7, where NVD labels 7.5 as High. The condition is FortiAuthenticator in HA. The weakness is CWE-287.
The NVD record scores it 7.5 (High) with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-287 (improper authentication). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Run get system status on the FortiGate to read the version, then check whether you authenticate admins or VPN users against a FortiAuthenticator pair in HA. If you do not, the stated condition is not met, but upgrading is still sensible.
In the Fortinet GUI, check RADIUS policies that use FortiToken Mobile push notifications.
What to do now
- Upgrade FortiOS to 7.4.2, 7.2.8 or 7.0.13 or later.
- If you cannot upgrade, disable push notifications on FortiAuthenticator: under RADIUS Service, Policies, open the policy, go to Authentication Factors, Advanced Options, and turn off Allow FortiToken Mobile push notifications.
- Review which accounts have read-only access and look for unexpected privilege changes.
- Check authentication logs for repeated login attempts.
- Record the FortiOS version and HA setup.
Why it matters
This is an authentication logic flaw rather than a memory bug. In the described setup, a series of login attempts can end with more access than the account should have. The effect is a read-only user becoming read-write on a firewall.
The vector rates attack complexity high because it depends on the HA arrangement, which narrows the exposed population. Fortinet offers a configuration workaround, which is rare enough to be worth using while you plan the upgrade.
Quick check
Do I need FortiAuthenticator in HA to be affected?
The advisory ties the flaw to that configuration.
Is there a workaround?
Yes. Disable FortiToken Mobile push notifications on FortiAuthenticator.
Sources
Last reviewed: 19 October 2026.
