Fortinet FortiOS CVE-2026-23573

The victim must be an authenticated user of the FortiOS, FortiPAM, or FortiProxy web management interface at the time the crafted request is processed - the XSS payload executes within their authenticated browser session, not against an unauthenticated endpoint. The attacker requires no authentication themselves (PR:N per CVSS), but must successfully deliver the malicious request or URL to a logged-in user (UI:R). Exploitation is limited to specific version ranges: FortiOS 7.2 all versions, 7.4 all versions, and 7.6.0-7.6.6; FortiPAM 1.0 through 1.8.0; FortiProxy 7.2.0-7.2.9 and 7.4.0-7.4.3 - FortiOS 7.0 and earlier are not listed as affected. Exposing the web management interface to untrusted networks dramatically increases exploitability; deployments where the admin interface is restricted to internal or VPN-only access substantially reduce risk. Note: the CVE description's phrasing 'authenticated remote user' creates ambiguity about whether the attacker or victim must be authenticated - verify against FG-IR-26-150.

The base CVSS score of 6.1 (Medium) is likely an underestimate of real-world risk for this vulnerability class and target. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-accessible exploitation with low complexity, no attacker authentication required, and scope change - but victim interaction is required. A notable discrepancy exists: the CVE description states 'authenticated remote user' as the party who can execute code or commands, while the CVSS vector specifies PR:N (no privileges required for the attacker); this is consistent with a reflected XSS scenario where the attacker is unauthenticated but the victim must be an authenticated session holder - however, this should be verified against the Fortiguard advisory FG-IR-26-150. The E:P temporal metric confirms proof-of-concept code is publicly available, which meaningfully raises exploitation likelihood. EPSS data was not provided; without it, exploitation probability cannot be quantified. The victims are almost certainly network administrators or security engineers, meaning successful XSS can yield session token theft, credential harvesting, or forced administrative actions with severe downstream consequences. The RL:O metric confirms an official patch is available, which should be the immediate priority.

An attacker identifies a FortiOS or FortiPAM administrator and crafts a malicious URL containing an XSS payload targeting the vulnerable web management interface. The attacker delivers the link via phishing email or a watering-hole attack; when the authenticated administrator clicks the link and the payload executes in their browser, the attacker can steal the session cookie, hijack the authenticated session, and perform privileged administrative actions - such as creating backdoor accounts or exfiltrating VPN credentials - with the administrator's full privileges. Publicly available proof-of-concept code lowers the technical barrier for this attack.