FortiOS FortiProxy CVE-2026-84393

Exploitation requires the attacker to occupy a network MITM position on the path between the affected FortiOS or FortiProxy device and a TLS-speaking backend service - this is the AC:H constraint and the primary limiting factor. No authentication to the Fortinet device is required (PR:N) and no user interaction is needed (UI:N) once the MITM position is established. The vulnerability affects FortiOS 7.6.1-7.6.6 and FortiProxy 7.6.2-7.6.6 specifically; deployments outside these version ranges are not listed as vulnerable. The exact triggering feature (SSL inspection pipeline, management-plane TLS calls, or proxy CONNECT tunnel) is not confirmed - the CVE description contains an unfilled template placeholder ('via <insert attack vector here>'), making the specific attack vector ambiguous beyond what the CWE and CVSS imply.

The CVSS 3.1 base score would be approximately 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H); the stated score of 7.3 is consistent with the temporal vector incorporating E:P (proof-of-concept), RL:O (official fix released), and RC:C (confirmed), which reduces the score to approximately 7.2-7.3. AC:H is the primary risk-limiting factor, requiring an attacker to first achieve a MITM position on the network path - a meaningful bar that prevents casual opportunistic exploitation. EPSS data is absent from the input; exploitation requires deliberate network positioning, so mass internet-scale attacks are unlikely. The A:H component in the provided CVSS seems overstated for a pure certificate mismatch flaw, which typically enables interception/tampering (C:H/I:H) but not denial of service. Real-world risk is highest for deployments where FortiProxy handles outbound SSL inspection or FortiOS makes authenticated backend calls, as those channels could be silently compromised. No KEV listing is present, and exploitation is not confirmed as actively occurring in the wild.

An attacker on a network path between the FortiOS/FortiProxy device and a backend server (e.g., update server, LDAP/RADIUS endpoint, or proxied destination) presents a TLS certificate that is valid for a different hostname. Because FortiOS/FortiProxy does not enforce hostname matching, it accepts the certificate and completes the handshake, allowing the attacker to read and modify traffic in the encrypted session. Proof-of-concept code exists per the E:P temporal CVSS indicator.