47
35
55
60
30
FortiOS and FortiProxy ZTNA Validation Vulnerability Allows Attacker to Perform a Man-in-the-Middle Attack
Fortinet discloses high-severity certificate validation flaw CVE-2026-84393 in FortiOS and FortiProxy Agentless ZTNA portals enabling unauthenticated man-in-the-middle attacks.
Fortinet disclosed CVE-2026-84393 (CVSSv3 7.3, CWE-295) on September 8, 2026 under advisory FG-IR-26-174: improper certificate validation in the Agentless ZTNA portal of FortiOS and FortiProxy. An unauthenticated attacker on the network path could present a forged or mismatched certificate and intercept or tamper with traffic between the portal and backend destinations, with impact classified as information disclosure. Affected versions are FortiOS 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6; the 8.0, 7.4 and 7.2 branches of both products are unaffected. Fortinet urges upgrading to 7.6.7 or later and reports no evidence of exploitation in the wild.
45
35
55
55
55
55
47
60
CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
CVE-2026-59969: Apache ZooKeeper quorum TLS skips peer hostname verification in FIPS-mode deployments, enabling potential server-to-server impersonation.
Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 fail to enforce peer hostname verification for quorum TLS when FIPS mode is enabled with sslQuorum, zookeeper.fips-mode, and hostname verification settings turned on. The flaw is rated important and could allow an attacker to impersonate a quorum peer via certificate host mismatch. Users should upgrade to fixed versions.
35
55
47
Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin
60
55
55
60
60
30
55
35
35
35
30
Microsoft Releases Patches for 16 Critical Flaws, Including a Zero
60
35
30
60
60
55
January 2018 Patch Tuesday security updates fix a zero
60
35
60
30
42
Update Windows 10 Immediately to Patch a Flaw Discovered by the NSA
60
30