EUVD-2026-76098
GHSA-g584-wqjw-m2r8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain FortiMonitorOnSight code/client resources
-
DeliveryExtract embedded secrets
-
ExploitAuthenticate with recovered credentials
-
ExecutionBypass access controls
-
ImpactAccess protected functionality/data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Source code protection
|
| Exploitation Conditions | Exploitation requires the target to be running FortiMonitorOnSight 7.2.0-7.2.2 or 7.2.4-7.2.7, and hinges on the attacker being able to access the source code or client-side code that contains the embedded sensitive information; the specific attack vector is NOT stated in the CVE (the description literally contains an '<insert attack vector here>' placeholder), so whether network reachability of a management endpoint or possession of a distributed artifact is the true prerequisite cannot be confirmed from the provided data. The CVSS PR:N/UI:N metrics imply no authentication or user interaction is needed, but this is unverified given the incomplete description and should be confirmed against FG-IR-26-170. |
| Impact | The input assigns CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), which is difficult to reconcile with a CWE-540 sensitive-information-in-source-code weakness: such flaws are typically confidentiality-driven, and the full I:H/A:H impact appears overstated absent a described mechanism to modify data or degrade availability. The vulnerability description also contains an unfilled template placeholder ('<insert attack vector here>'), so the actual attack vector is not confirmed by the source data - the network vector and low complexity should be treated as unverified until Fortinet's FG-IR-26-170 advisory is consulted. There is no EPSS score, no CISA KEV listing, and no POC in the provided data, so this reads as a high-nominal-CVSS issue whose real-world exploitability is presently unquantified; the Fortinet name and network-facing rating nonetheless warrant prompt patching by any operator running the affected on-premises builds. Verify the true attack vector and impact against the vendor advisory before finalizing priority. |
| Exploit ScenarioDerived | An attacker who obtains the FortiMonitorOnSight code or client-accessible resources extracts embedded secrets and uses them to authenticate or reach functionality they should not have, bypassing the product's access controls. Because the CVSS vector indicates a network vector with no authentication or user interaction, this could in principle be performed remotely, though the exact delivery path is not documented (the CVE description's attack-vector field is an unfilled placeholder). No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 11, 2026
Sensitive information embedded in the source code of Fortinet FortiMonitorOnSight (7.2.0-7.2.2 and 7.2.4-7.2.7) can be recovered by an attacker and leveraged to bypass access controls. The exposed data (CWE-540) may include credentials, keys, or other secrets that grant unauthorized access to protected functionality. No public exploit is identified at time of analysis, and the CVE's own attack-vector text is an unfilled placeholder, so the exact delivery path is not documented by the vendor.
Earlier versions of this analysis (1)
Sensitive information disclosure in Fortinet FortiMonitorOnSight (versions 7.2.0-7.2.2 and 7.2.4-7.2.7) stems from secrets embedded directly in shipped source code, which can be leveraged to defeat access controls and reach restricted functions or data. Fortinet rates it CVSS 9.6 and marks an official fix as available; no public exploit or CISA KEV listing is present in the supplied data, though the CVSS temporal metrics assert a functional exploit exists. The public description is a garbled template ('<insert attack vector here>'), so the precise trigger is not documented in the available intelligence.
RemediationAI
Consult Fortinet PSIRT advisory FG-IR-26-170 (https://fortiguard.fortinet.com/psirt/FG-IR-26-170) and upgrade to the fixed FortiMonitorOnSight build it specifies; the input data does not include an exact patched version number, so treat the advisory as the source of the fix version rather than inventing one - Patch available per vendor advisory. Until patched, rotate any credentials, API keys, or secrets that may have been embedded in or derivable from the affected code, and restrict network access to the FortiMonitorOnSight management interface to trusted administrative networks to reduce exposure while the fix is staged; note that access restriction may disrupt legitimate remote monitoring integrations and should be validated in a maintenance window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FortiMonitorOnSight is the on-premises appliance/agent variant of Fortinet's FortiMonitor infrastructure- and application-monitoring platform, identified by CPE cpe:2.3:a:fortinet:fortimonitoronsight. The root cause is CWE-540 (Inclusion of Sensitive Information in Source Code): secrets or sensitive logic are shipped inside distributed source or client-accessible code rather than being externalized and protected. When such material includes authentication secrets or authorization tokens, disclosure directly undermines the product's access-control model, which is how Fortinet characterizes the downstream 'improper access control' impact.
Know when Fortimonitoronsight gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-540 sensitive-info exposure is confidentiality-driven; downstream access-control bypass yields limited integrity impact (I:L) and no availability impact, so C:H/I:H/A:H is overstated.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via <insert attack vector here>
Articles & Coverage 1
Executive ViewAI
Fortinet FortiMonitorOnSight versions 7.2.0-7.2.7 expose sensitive credentials and authentication material embedded in the application source code, enabling attackers to extract these secrets and bypass access controls to gain unauthorized administrative access. Organizations relying on this product for monitoring infrastructure security face immediate risk of security perimeter compromise, with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to FortiMonitorOnSight to trusted administrative networks only via firewall and network segmentation; (2) Implement enhanced monitoring and alerting on all authentication attempts and API access to detect exploitation; (3) Immediately rotate all credentials, API keys, and authentication tokens potentially exposed by or managed within affected versions; (4) Review system access logs and authentication records for indicators of unauthorized access or lateral movement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB