Reported by 9 outlets
Fortinet patches critical authentication bypass and proxy flaws across product line
Why this score
- Breadth
- 2.00 / 2.0 · 9 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Fortinet's September 8 batch patched ten vulnerabilities, and the two criticals are not equal threats. CVE-2026-84390 (CVSS 9.6, CWE-540) is an inclusion of sensitive information in source code in the FortiMonitorOnSight web portal: the advisory title states the JWT used for GUI authentication is signed with a static key, so a remote unauthenticated attacker can bypass authentication with a forged or reused token. Fortinet TAC's Cameron Milstead found it internally, and FortiMonitorOnSight 7.2.0 through 7.2.2 and 7.2.4 through 7.2.7 need 7.2.8 or above. CVE-2026-84388 (CVSS 9.1, CWE-287) is improper authentication in the Fortinet Privileged Access Agent Chrome extension, where one visit to a malicious website lets an attacker steer the browser's proxy, open tabs, and capture the extension's privileged-session screen recordings. That fix requires two components moved together: FortiPAM at 1.9.1 or 1.8.4 and the extension at 8.0.1.123 or above. Researcher James Arnott of Bay Area Labs reported the extension chain to Fortinet on July 17 and says the extension fix shipped August 1, six weeks before the coordinated advisory; Fortinet credits four external reporters and marks both issues Known Exploited: No.
The CVSS ranking inverts the operational risk. The OnSight portal bug needs no user interaction, and CISA's SSVC scoring marks it automatable with total technical impact, while the advisory's own framing, a static signing key instead of a per-installation secret, implies one forgery recipe works against every unpatched portal rather than an attack that must be rebuilt per target. The extension bug demands a user misstep, but on an admin workstation it hands over exactly what FortiPAM exists to protect: credential injection into sessions, proxy policy control, and audit recordings of privileged access, against an install base the disclosure puts at more than one million users. Neither CVE is in KEV, EPSS sits below one percent for both (0.00377 and 0.00522), and CISA rates exploitation as none, so this is a patch-now story rather than an incident response. The combination of an automatable unauthenticated server bypass and a client-side PAM hijack in the same vendor drop, plus a public proof-of-concept video for the extension chain, is why this batch outranks routine Fortinet Tuesday noise.
Inventory both products before touching anything else. FortiMonitorOnSight 7.2.0 through 7.2.2 and 7.2.4 through 7.2.7 upgrade to 7.2.8 or above, and the portal should sit behind management-network restrictions until that lands; check its access logs for repeated or anomalous JWT acceptance while scoping, since forged or reused tokens were the stated vector. For FortiPAM, verify the appliance is at 1.9.1 or 1.8.4 and separately confirm the Chrome extension fleet-wide is at 8.0.1.123 or above, because appliance version alone proves nothing; extension 7.4 all versions has no in-place fix and must migrate. In proxy and egress logs, hunt HTTPS requests to /api/v2/monitor/web-ui/state aimed at hosts that are not legitimate FortiPAM servers, since the disclosure shows any hostname receiving that path was silently added to the extension's trusted-server list, and the consent dialog selectors named in the write-up (fortinet-sv-modal-overlay, .sv-btn-allow) give browser forensics a concrete artifact to look for. The same drop carried high-severity fixes for FortiSandbox (CVE-2026-26084) and the FortiOS and FortiProxy agentless ZTNA portal (CVE-2026-84393, man-in-the-middle), with FortiOS 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6 on the affected list, so sweep those in the same maintenance window.
Two developments would change this assessment. Any exploitation signal against either CVE, a KEV listing, or vendor confirmation would move the OnSight flaw from patch-now to incident triage given its unattended and automatable profile, and Fortinet's Known Exploited flags and CISA's none ratings are the current baseline to measure against. The other is NVD's pending analysis, which has already scored CVE-2026-84390 at 9.8 against the vendor's 9.6, a signal the severity consensus is still moving; combined with the six-week gap between the August 1 extension fix and the September 8 advisory, any widening of that gap in public reporting would justify assuming the PoC has circulated longer than the disclosure timeline suggests.
Timeline
-
original reporting
Fortinet Patches Critical Authentication Bypass and Proxy Flaws Across Product Line Fortinet patched 10 vulnerabilities, including two criti
beyondmachines.net · 33d ago · September 10th, 2026
Fortinet Patches Critical Authentication Bypass and Proxy Flaws Across Product Line Fortinet patched 10 vulnerabilities, including two criti
via Mastodon https://beyondmachines.net/event_details/fortinet-patches-critical-authentication-bypass-and-proxy-flaws-across-product-line-t-c-t-4-1/gD2P6Ple2L
-
update from fortiguard.fortinet.com
FG-IR-26-170: JWT used for authentication in web GUI signed with static key (FortiMonitorOnSight, CVE-2026-84390)
fortiguard.fortinet.com · 36d ago · September 8th, 2026
Fortinet PSIRT advisory for CVE-2026-84390 (CVSSv3 9.6, CWE-540, Critical): an inclusion of sensitive information in source code in the FortiMonitorOnSight web portal, where the JWT used for GUI authentication is signed with a static key, letting a remote unauthenticated attacker bypass authentication via a forged or reused JWT. FortiMonitorOnSight 7.2.0 through 7.2.2 and 7.2.4 through 7.2.7 are affected; the fix is 7.2.8 or above. Internally discovered by Cameron Milstead of Fortinet TAC. Known Exploited: No. Timeline shows initial publication 2026-09-08, one day before the story's first_seen.
-
update from fortiguard.fortinet.com
FG-IR-26-168: Improper Authentication of FortiPAM Server (Fortinet Privileged Access Agent Chrome extension, CVE-2026-84388)
fortiguard.fortinet.com · 36d ago · September 8th, 2026
Fortinet PSIRT advisory for CVE-2026-84388 (CVSSv3 9.1, CWE-287, Critical): an improper authentication flaw in the Fortinet Privileged Access Agent Chrome extension may let a remote unauthenticated attacker proxy a user's browser traffic through attacker-controlled servers if the user visits a malicious website. FortiPAM Chrome Extension 8.0 and 7.4 all versions are affected; remediation requires FortiPAM upgraded to 1.9.1 or 1.8.4 plus the Chrome extension at 8.0.1.123 or above. Credited to Kevin Joensen (Baldur Security), Eric Brandel (Target), Dan Rosenqvist (Shelltrail), and James Arnott (Bay Area Labs). Known Exploited: No, virtual patching: No.
-
update from amibeingpwned.com
Fortinet Privileged Access Agent: Any Site Could Control Your Proxy and Watch Your Tab
amibeingpwned.com · 35d ago · September 9th, 2026
Original researcher write-up of CVE-2026-84388 by James Arnott of Bay Area Labs, covering the extension used by more than 1 million users: a webRequest listener on the path https://*/api/v2/monitor/web-ui/state added any requested hostname to the trusted-server list without checking the initiator or request success, externally_connectable was set to all URLs, non-JWT access tokens skipped validation instead of failing, and the page could click its own consent dialog (elements fortinet-sv-modal-overlay and .sv-btn-allow). Arnott states Bay Area Labs reported the issue to Fortinet on July 17 and the fix shipped August 1, and that there is no known real-world exploitation. The page displays date only (9 September 2026, no time of day); published_at is normalized to start of day UTC.
-
update from cyberpress.org
Fortinet FortiPAM Chrome Extension Flaw Lets Attackers Hijack Browser Proxy and Record Tabs
cyberpress.org · 34d ago · September 9th, 2026
A critical vulnerability in Fortinet’s FortiPAM Chrome extension could have allowed a malicious website to take control of privileged browser-session settings, set a browser proxy, open attacker-selected tabs, and exfiltrate screen recordings. Security researcher James Arnott disclosed the issue in Fortinet’s Privileged Access Management browser component, which helps broker privileged sessions by opening targets, injecting credentials, applying proxy policies, and recording user activity for audit purposes. Fortinet FortiPAM Chrome Extension Flaw Those features become high risk when an arbitrary website can influence the extension’s trusted server and session configuration. The attack relied on a series of flaws that could be combined without compromising a legitimate FortiPAM server. The logic did not validate the request initiator or confirm the request had completed successfully. A malicious site could therefore request its own attacker-controlled domain, trigger the listener, and cause FortiPAM to consider that domain trusted. The extension’s external messaging configuration amplified the problem. Its externally_connec
-
update from gbhackers.com
FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs
gbhackers.com · 34d ago · September 9th, 2026
This issue, tracked as CVE-2026-84388 and rated with a CVSS score of 9.1, impacts an extension that facilitates privileged access […] The post FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from malware.news
Fortinet security advisory (AV26-898)
malware.news · 34d ago · September 9th, 2026
Serial Number: AV26-898 Date: September 9, 2026 As of September 8, 2026, Fortinet is affected by vulnerabilities in the following products: FortiOS 7.6 Versions 7.6.1 to 7.6.6 FortiProxy 7.6 Versions 7.6.2 to 7.6.6 FortiPAM Chrome Extension 8.0 All versions FortiPAM Chrome Extension 7.4 All versions FortiSandbox 5.0 Versions 5.0.0 to 5.0.5 FortiSandbox 4.4 Versions 4.4.0 to 4.4.8 FortiSandbox Cloud 5.0 Versions 5.0.4 to 5.0.5 FortiSandbox PaaS 5.0 Versions 5.0.4 to 5.0.5 FortiMonitorOnSight 7.2 Versions 7.2.4 to 7.2.7 FortiMonitorOnSight 7.2 Versions 7.2.0 to 7.2.2 The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
-
update from securityweek.com
Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension
securityweek.com · 34d ago · September 9th, 2026
To be fully secure, customers should upgrade FortiPAM to 1.9.1 or 1.8.4, and ensure the Chrome extension is at version 8.0.1.123 or above,” the company notes. Fortinet also patched high-severity bugs in FortiSandbox (CVE-2026-26084) and FortiOS and FortiProxy Agentless ZTNA portal (CVE-2026-84393) that could allow attackers to access sensitive information and perform man-in-the-middle (MitM) attacks, respectively. The remaining vulnerabilities resolved on Tuesday are medium- and low-severity issues in FortiManager, FortiAnalyzer, Fort
-
mentioned by app.opencve.io
New advisory CRITICAL: CVE-2026-84388: Fortinet Fortipam Chrome Extension: https:// app.opencve.io/cve/?vendor=for tinet&product=fortipam_ch
app.opencve.io · 21d ago · September 22nd, 2026
-
update from www.yazoul.net
🔴 New security advisory: CVE-2026-84388 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
www.yazoul.net · 20d ago · September 23rd, 2026
🔴 New security advisory: CVE-2026-84388 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
via Mastodon https://www.yazoul.net/advisory/cve/cve-2026-84388-fortipam-chrome-extension-leaks-credentials-poc
-
mentioned by www.yazoul.net
🔴 New security advisory: CVE-2026-84388 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
www.yazoul.net · 20d ago · September 23rd, 2026
-
update from app.opencve.io
Fortinet posted a critical vulnerability yesterday: CVE-2026-84388 - Improper Restriction of Rendered UI Layers or Frames in FortiPAM Chrome
app.opencve.io · 15d ago · September 28th, 2026
Fortinet posted a critical vulnerability yesterday: CVE-2026-84388 - Improper Restriction of Rendered UI Layers or Frames in FortiPAM Chrome
via Mastodon https://app.opencve.io/cve/CVE-2026-84388