This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Fortinet fixes 11 vulnerabilities in various products
Fortinet fixes 11 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: FortiMonitorOnSight - 7.2.8 [1] FortiPAM - 1.9.1 [2][11] FortiPAM Chrome Extension - 8.0.1.123 [2] FortiSandbox (including Cloud) - 4.4.10, 5.0.7, 5.2.1 [3][4] FortiOS - 7.6.7 [5][11] FortiProxy - 7.6.7 [5][11] FortiAnalyzer - 7.6.7 [6] FortiSOAR - 7.5.4, 7.6.7 [7] FortiClient Windows - 7.4.8 [8] FortiManager (including Cloud) - 7.4.11, 7.6.5 [9] FortiSIEM - 7.5.2 [10]
An unauthenticated remote attacker can bypass authentication in FortiMonitorOnSight using a forged or replayed JWT [1].
The vulnerability is present in product:
- FortiMonitorOnSight; >=7.2.4, <7.2.8;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
More information:
- CVE-2026-84390 at cve.org, NVD
- CWE-540: Inclusion of Sensitive Information in Source Code at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
An unauthenticated remote attacker can redirect the user's browser traffic in FortiPAM and the FortiPAM Chrome Extension if the user visits a malicious web page [2].
The vulnerability is present in products:
- FortiPAM; >=1.8.0, <1.8.4; >=1.9.0, <1.9.1;
- FortiPAM Chrome Extension; >=7.4; >=8.0, <8.0.1.123;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L/E:P/RL:O/RC:C
More information:
- CVE-2026-84388 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
An unauthenticated remote attacker can gain access to sensitive information in FortiSandbox (including Cloud and PaaS) by sending specially crafted HTTP requests [3].
The vulnerability is present in products:
- FortiSandbox; >=4.4.0, <4.4.9; >=5.0.0, <5.0.6;
- FortiSandbox Cloud; >=5.0.4, <5.0.6;
- FortiSandbox PaaS; >=5.0.4, <5.0.6;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H/E:P/RL:O/RC:C
More information:
- CVE-2026-26084 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
An unauthenticated remote attacker can carry out a MitM attack on the communication channel between the agentless ZTNA portal in FortiOS and FortiProxy and the target backend website [5].
The vulnerability is present in products:
- FortiOS; >=7.6.1, <7.6.7;
- FortiProxy; >=7.6.2, <7.6.7;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
More information:
- CVE-2026-84393 at cve.org, NVD
- CWE-295: Improper Certificate Validation at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
An authenticated remote attacker can execute code or commands in FortiSandbox by sending specially crafted HTTP requests [4].
The vulnerability is present in product:
- FortiSandbox; >=4.4.0, <4.4.10; >=5.0.0, <5.0.7; >=5.2.0, <5.2.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
More information:
- CVE-2026-84387 at cve.org, NVD
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
An authenticated remote attacker with user rights can cause a denial of service in the SNMP daemon of FortiAnalyzer by means of SNMP GETBULK requests [6].
The vulnerability is present in product:
- FortiAnalyzer; >=7.6.3, <7.6.7;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
More information:
- CVE-2026-84391 at cve.org, NVD
- CWE-457: Use of Uninitialized Variable at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
An authenticated remote attacker without assigned privileges can subscribe to websocket streams and inject broadcast messages into them in FortiSOAR by means of specially crafted requests [7].
The vulnerability is present in products:
- FortiSOAR PaaS; >=7.3, <7.5.4; >=7.6.0, <7.6.7;
- FortiSOAR; >=7.3, <7.5.4; >=7.6.0, <7.6.7;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
More information:
- CVE-2026-84385 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
An authenticated local attacker can terminate arbitrary processes in FortiClient Windows (via the fortimon3 driver) through an exposed minifilter communication port [8].
The vulnerability is present in product:
- FortiClientWindows; >=7.2, <7.4.8;
CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:O/RC:C
More information:
- CVE-2026-84386 at cve.org, NVD
- CWE-283: Unverified Ownership at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
An authenticated remote attacker with administrator rights can bypass the approval process for workflow sessions in FortiManager by means of specially crafted HTTP/HTTPS requests [9].
The vulnerability is present in products:
- FortiManager; >=7.2, <7.4.11; >=7.6.0, <7.6.5;
- FortiManager Cloud; >=7.2, <7.4.11; >=7.6.0, <7.6.5;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C
More information:
- CVE-2026-22575 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
An authenticated remote attacker can cause a redirect to a potentially untrusted website in FortiSIEM by means of specially crafted HTTP requests [10].
The vulnerability is present in product:
- FortiSIEM; >=7.4.1, <=7.4.2; >=7.5.0, <7.5.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
More information:
- CVE-2026-84389 at cve.org, NVD
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect') at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
An authenticated remote attacker can crash the httpsd daemon in FortiOS, FortiPAM and FortiProxy by means of specially crafted HTTP requests [11].
The vulnerability is present in products:
- FortiOS; >=7.2, <7.6;
- FortiPAM; >=1.0, <1.9.1;
- FortiProxy; >=7.2, <7.6.7;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
More information:
- CVE-2026-84392 at cve.org, NVD
- CWE-476: NULL Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
Links
- [1] https://fortiguard.fortinet.com/psirt/FG-IR-26-170
- [2] https://fortiguard.fortinet.com/psirt/FG-IR-26-168
- [3] https://fortiguard.fortinet.com/psirt/FG-IR-26-166
- [4] https://fortiguard.fortinet.com/psirt/FG-IR-26-167
- [5] https://fortiguard.fortinet.com/psirt/FG-IR-26-174
- [6] https://fortiguard.fortinet.com/psirt/FG-IR-26-172
- [7] https://fortiguard.fortinet.com/psirt/FG-IR-26-164
- [8] https://fortiguard.fortinet.com/psirt/FG-IR-26-165
- [9] https://fortiguard.fortinet.com/psirt/FG-IR-26-171
- [10] https://fortiguard.fortinet.com/psirt/FG-IR-26-169
- [11] https://fortiguard.fortinet.com/psirt/FG-IR-26-173
By CESNET, z.s.p.o. Ondrej Pavlovič on 11. 9. 2026.