An improper certificate validation vulnerability exists in multiple versions of Fortinet FortiAnalyzer and FortiManager products, including their cloud variants. This flaw may allow a man-in-the-middle (MITM) attacker to impersonate a RADIUS server by presenting a rogue RADIUS server certificate. The vulnerability affects FortiAnalyzer versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, and all versions of 7.2, as well as corresponding FortiAnalyzer Cloud versions. Similarly, FortiManager versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.11, and all versions of 7.2, including their cloud variants, are affected. The vulnerability is identified as CWE-295 and has a CVSS v3.1 base score of 7.5 (high severity). No public exploits or patches are currently documented.