EUVD-2026-43718
GHSA-7r2p-wwg4-j6v8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered XSS requiring victim interaction (UI:R); no attacker auth needed (PR:N); scope changes to victim browser (S:C); limited C and I impact, no A impact.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
2DescriptionCVE.org
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9 may allow an authenticated remote user to execute code or commands via crafted requests.
AnalysisAI
Reflected or stored cross-site scripting in Fortinet FortiOS, FortiPAM, and FortiProxy web interfaces allows a remote unauthenticated attacker to execute JavaScript in the browser session of an authenticated administrator via crafted HTTP requests. The CVSS temporal metric E:P confirms publicly available proof-of-concept exploit code exists, and the RL:O metric confirms Fortinet has released an official fix. No active exploitation has been confirmed by CISA KEV at time of analysis, but the combination of a POC and the high-value targets (network security appliances and privileged access management systems) elevates real-world risk beyond what the base CVSS score of 6.1 suggests.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the vulnerability stems from insufficient sanitization of user-controlled input before it is rendered in the web management interface. The affected products - identified via CPE strings cpe:2.3:a:fortinet:fortios:*, cpe:2.3:a:fortinet:fortiproxy:*, and cpe:2.3:a:fortinet:fortipam:* - are network security appliances and a privileged access management platform, whose administrative web interfaces are the attack surface. The CVSS S:C (scope changed) metric confirms the XSS payload executes in a security context outside the application itself (the victim's browser), consistent with a classic reflected or stored XSS attack vector. FortiProxy operates as a web proxy and secure web gateway; FortiPAM manages privileged credentials and sessions - both represent particularly sensitive targets for session hijacking via XSS.
RemediationAI
Apply the official patch released by Fortinet as indicated by the CVSS temporal metric RL:O (Official Fix). Consult the Fortiguard PSIRT advisory FG-IR-26-150 at https://fortiguard.fortinet.com/psirt/FG-IR-26-150 for exact patched version numbers; no specific fix versions are independently confirmed from the available input data beyond the advisory reference. While patching, restrict administrative web interface access to trusted IP ranges using Fortinet's trusted host configuration feature, reducing the attack surface by limiting who can send crafted requests to the management interface - the trade-off is operational inconvenience for administrators working from variable IPs. Avoid exposing the FortiOS, FortiProxy, or FortiPAM web management interfaces directly to the internet; place them behind VPN or a jump host if not already the case. Multi-factor authentication on administrative accounts limits the impact of session token theft even if XSS is successful.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Arbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today