Loading story…
A critical vulnerability in Fortinet's FortiPAM Chrome extension, tracked as CVE-2026-84388 and rated CVSS 9.1, allowed a malicious website to register itself as a trusted FortiPAM server and invoke the privileged-access extension without valid JWT authentication. FortiPAM is a privileged-access-management component reported to have more than one million users.
An attacker could provide a malicious privileged-session configuration that changed the browser proxy, opened an attacker-selected tab, automatically approved the extension's consent prompt, and streamed recordings of that tab to an attacker-controlled server. The flaw enabled low-effort phishing and exposure of sensitive content, including API keys, viewed in the opened tab; it was reported July 17 and fixed August 1, with no known in-the-wild exploitation reported.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Fortinet patched CVE-2026-84390, a CVSS 9.6 FortiMonitorOnSight web-portal flaw that could allow remote unauthenticated attackers to bypass authentication with forged or reused JSON Web Tokens. Fortinet said none of the vulnerabilities addressed in the release were known to be exploited in the wild.
Fortinet released a fix for the FortiPAM Chrome extension flaw and published advisory FG-IR-26-168. The vulnerability could let a malicious site alter the browser proxy, open an attacker-selected tab, approve consent, and stream recordings to an attacker-controlled server.
Researchers reported CVE-2026-84388, a CVSS 9.1 flaw allowing an arbitrary website to become a trusted FortiPAM server, invoke the extension, and provide a malicious privileged-session configuration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcereddit.com
Open sourceamibeingpwned.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet has disclosed a critical security vulnerability in its FortiPAM privileged access management solution, identified as CVE-2025-49201. This vulnerability is caused by weak authentication in the GUI component of several FortiPAM versions, including all releases of 1.0, 1.1, 1.2, and 1.3, as well as versions 1.4.0 through 1.4.2 and 1.5.0. The flaw allows remote, unauthenticated attackers to execute unauthorized code or commands by sending specially crafted HTTP requests to the affected system. Security researchers and Fortinet’s own Product Security Incident Response Team (PSIRT) have confirmed that exploitation of this vulnerability could result in complete system compromise, giving attackers full control over privileged access management infrastructure. The vulnerability is rated as high severity, with a CVSS score of 7.4 according to runZero and 8.1 according to CVEfeed, reflecting the significant risk posed to organizations using vulnerable FortiPAM deployments. FortiPAM is widely used to manage and monitor privileged access to sensitive IT and OT assets, making exploitation of this flaw particularly dangerous for organizations with critical infrastructure. Fortinet has released security advisories and recommends immediate upgrades to fixed versions: users of FortiPAM 1.4 should upgrade to 1.4.3 or later, and those on 1.5 should move to 1.5.1 or later. For earlier versions (1.0 through 1.3), migration to a fixed release is required. The vulnerability also affects FortiSwitchManager versions 7.2.0 through 7.2.4, broadening the potential attack surface. Organizations are urged to identify vulnerable assets in their environments, with runZero providing specific asset inventory queries to assist in detection. No workarounds have been detailed, making patching the only effective mitigation. The vulnerability was publicly disclosed on October 14, 2025, and Fortinet has provided technical details and remediation guidance through its official channels. Security teams should prioritize patching due to the remote exploitability and the critical role of FortiPAM in managing privileged access. The exposure of privileged credentials and session monitoring functions could have cascading impacts if exploited, including lateral movement and further compromise of sensitive systems. The vulnerability underscores the importance of timely patch management and continuous asset discovery for privileged access management solutions. Organizations should also review access logs and monitor for signs of unauthorized activity on FortiPAM systems. Given the high-profile nature of Fortinet products in enterprise environments, threat actors may rapidly attempt to exploit unpatched systems. Fortinet’s PSIRT remains the authoritative source for updates and further technical advisories regarding CVE-2025-49201.
Jul 12, 2026
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026
Attackers are actively exploiting a command injection vulnerability in Fortinet FortiWeb, tracked as CVE-2025-58034, which allows authenticated users to execute unauthorized code on affected systems. The flaw, caused by improper neutralization of special elements in the `policy_scripting_post_handler` method, enables code execution as root via crafted HTTP requests or CLI commands. Fortinet released patches for affected FortiWeb versions between October 23 and 31, 2025, but did not publicly disclose the vulnerability at the time. The issue was privately reported by a Trend Micro researcher, and both Fortinet and CISA have confirmed active exploitation, with CISA adding the CVE to its Known Exploited Vulnerabilities catalog and mandating rapid remediation for US federal agencies. Security researchers warn that proof-of-concept code for CVE-2025-58034 may soon be publicly available, increasing the risk of widespread attacks. There is currently no workaround for this vulnerability, and organizations are urged to upgrade to the fixed FortiWeb versions immediately and check for signs of compromise. The vulnerability requires authentication to exploit, but successful exploitation grants attackers root-level access. The disclosure timeline shows the vulnerability was reported in June 2025 and publicly disclosed in November 2025, with coordinated advisories from both Fortinet and the Zero Day Initiative.
Jun 29, 2026