Loading story…
Fortinet disclosed CVE-2026-84393, a high-severity improper certificate-validation flaw (CWE-295) in the Agentless ZTNA portal components of FortiOS and FortiProxy. An unauthenticated attacker able to position themselves on the network path could conduct a man-in-the-middle attack between the ZTNA portal and its backend destination website, potentially intercepting, disclosing, or modifying session and application traffic.
The vulnerability carries a CVSS v3 score of 7.3 and affects FortiOS versions 7.6.1 through 7.6.6 and FortiProxy versions 7.6.2 through 7.6.6. Fortinet's advisory FG-IR-26-174 recommends upgrading affected systems to version 7.6.7 or later; the company reported no evidence of active exploitation and the flaw is not currently listed as known exploited.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CISA added an SSVC record for CVE-2026-84393, assessing exploitation as none and automation as no. The assessment rated the vulnerability's technical impact as total.
Fortinet published advisory FG-IR-26-174 for CVE-2026-84393, a CVSS 7.3 improper certificate-validation vulnerability (CWE-295) in Agentless ZTNA portals. The flaw affects FortiOS 7.6.1–7.6.6 and FortiProxy 7.6.2–7.6.6, and could allow an on-path unauthenticated attacker to intercept or modify portal-to-backend traffic; Fortinet recommended upgrading to 7.6.7 or later and reported no evidence of exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026
Fortinet disclosed **CVE-2023-25610**, a critical buffer-underwrite flaw in the HTTP/HTTPS administrative interface of FortiOS and FortiProxy. A remote, unauthenticated attacker can send crafted requests to execute arbitrary code on vulnerable appliances; certain additional Fortinet products may be susceptible to denial-of-service conditions. A public proof of concept was released shortly after the advisory, increasing the risk of exploitation. Organizations should immediately apply Fortinet’s updates and, where patching cannot occur promptly, restrict or disable internet-exposed HTTP/HTTPS administrative access. Wiz reported that 9% of cloud enterprise environments were exposed and that 80% of surveyed FortiOS-using environments had not yet patched.
Sep 3, 2026
Fortinet reported limited active exploitation of **CVE-2024-21762**, a critical out-of-bounds write vulnerability in the `sslvpnd` component of FortiOS SSL-VPN. An unauthenticated remote attacker can trigger denial of service or execute arbitrary code, potentially taking control of a vulnerable FortiGate appliance. The vulnerability is rated CVSS 9.6, and public proof-of-concept exploit code became available. Organizations running affected FortiOS 7.4 and earlier releases should apply Fortinet’s security updates immediately; FortiOS 7.6 is not affected. The Dutch National Cyber Security Centre assessed the issue as High/High due to its impact, active exploitation, and expected exploit availability, and advised disabling SSL-VPN as a temporary mitigation where immediate patching is not possible.
Sep 3, 2026