CVE-2025-49201 is a high severity weak authentication flaw (CVSS 8.1) in Fortinet FortiPAM and FortiSwitchManager. Fortinet says the web interface can be attacked to bypass authentication by brute force. Fixed in FortiPAM 1.5.1 and 1.4.3, FortiSwitchManager 7.2.5. Older FortiPAM branches must migrate.
What's affected
Fortinet's advisory FG-IR-25-010 lists these versions and fixes:
- FortiPAM 1.5: version 1.5.0 is affected. Upgrade to 1.5.1 or above.
- FortiPAM 1.4: versions 1.4.0 through 1.4.2 are affected. Upgrade to 1.4.3 or above.
- FortiPAM 1.3, 1.2, 1.1 and 1.0: all versions are affected. Migrate to a fixed release.
- FortiPAM 1.7 and 1.6: not affected.
- FortiSwitchManager 7.2: versions 7.2.0 through 7.2.4 are affected. Upgrade to 7.2.5 or above.
- FortiSwitchManager 7.0: not affected.
The advisory names the web interface component, and describes the attack type as unauthenticated. It lists Known Exploited as No, and the issue was found internally by Fortinet's product security team.
How to check if you're exposed
Read the version from the device. On the command line, FortiOS style products usually report it with:
get system status
On FortiPAM and FortiSwitchManager the version is also displayed in the web interface dashboard. Compare it to the table above. Then check where the management interface listens. A privileged access management system is a high value target, so its administrative interface should not be reachable from the internet.
Also review authentication logs for repeated failed logins from one address or a spread of addresses, because the advisory describes a brute force path.
What to do now
- List all FortiPAM and FortiSwitchManager devices and their versions.
- Upgrade to the fixed version for your branch, or migrate if you run FortiPAM 1.0 to 1.3.
- Limit the management interface to a trusted management network, and use Fortinet's local in policy options if available.
- Enforce multi factor authentication and lockout settings for administrators.
- Review authentication logs for failed login bursts and for unfamiliar successful logins.
- Read the advisory itself for the latest guidance, since vendors update these pages.
Why it matters
The record files this as CWE-1390, weak authentication. The NVD text speaks of crafted HTTP requests leading to unauthorised code or commands, while Fortinet's own summary describes bypassing the authentication process by brute force. Both point to a login mechanism that does not hold up against an attacker who can talk to it.
Privileged access management tools hold the keys to other systems, which is why the CVSS vector rates impact as high for confidentiality, integrity and availability. High attack complexity keeps the score at 8.1 rather than higher. This CVE is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
I run FortiPAM 1.3. What should I do?
Fortinet says all of the 1.3 branch is affected and advises migrating to a fixed release. There is no patch release on that branch.
Is it being exploited?
Fortinet lists Known Exploited as No, and the CVE is not in the CISA catalogue. Treat that as a snapshot and check again.
Sources
Last reviewed: 18 October 2026.
