EUVD-2026-72927
GHSA-7mc8-g97x-qg4j
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
MITM position needed (AC:H); cert mismatch enables interception and tampering (C:H/I:H) but not availability impact (A:N).
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via <insert attack vector here>
Articles & Coverage 1
AnalysisAI
Improper certificate hostname validation (CWE-297) in Fortinet FortiOS and FortiProxy enables network-adjacent attackers to conduct man-in-the-middle attacks against outbound TLS connections made by affected devices. Fortinet FortiOS versions 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6 fail to verify that a presented certificate matches the intended hostname, allowing a suitably positioned attacker to intercept and potentially tamper with encrypted traffic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to occupy a network MITM position on the path between the affected FortiOS or FortiProxy device and a TLS-speaking backend service - this is the AC:H constraint and the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score would be approximately 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H); the stated score of 7.3 is consistent with the temporal vector incorporating E:P (proof-of-concept), RL:O (official fix released), and RC:C (confirmed), which reduces the score to approximately 7.2-7.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - upgrade FortiOS and FortiProxy to a version beyond the affected ranges (above 7.6.6 for both products) as directed by Fortinet advisory FG-IR-26-174 at https://fortiguard.fortinet.com/psirt/FG-IR-26-174; the specific patched release versions are not explicitly stated in the available data and should be confirmed from the advisory directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all FortiOS and FortiProxy instances running versions 7.6.1 through 7.6.6 and identify those handling sensitive or critical outbound TLS traffic. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today