CVE-2026-84390

CVE-2026-84390 is a critical (CVSS 3.1: 9.8) information-disclosure flaw in Fortinet FortiMonitorOnSight in which sensitive information is included in the product's source code (CWE-540). An unauthenticated, network-located attacker who obtains that embedded material (e.g., secrets or credentials shipped with the code) can use it to gain improper access by subverting access controls; the CVSS vector requires no privileges or user interaction and rates the impact high on confidentiality, integrity, and availability. All FortiMonitorOnSight deployments running the affected 7.2.x releases listed by Fortinet (7.2.0 through 7.2.2 and 7.2.4 through 7.2.7) are affected. Fortinet has shipped fixes for this flaw, but there is no public proof-of-concept, the vulnerability is not in CISA KEV, and no exploitation in the wild is currently known.

What to do: Upgrade FortiMonitorOnSight to a fixed release per Fortinet's PSIRT advisory, i.e., any version superseding the listed 7.2.0-7.2.2 and 7.2.4-7.2.7 ranges. Because the flaw involves sensitive material in source code, also rotate any credentials, keys, or secrets associated with the deployment and review logs for signs of unauthenticated access. Until patched, restrict network exposure of the OnSight management interface to trusted networks only.