Search: “fortisoar”

Broken Access control on Websocket streams

Fortinet FortiSOAR access control flaw (CVSS 4.9) lets zero-permission authenticated attackers subscribe to and inject broadcast messages into websocket streams.

Fortinet advisory FG-IR-26-164 discloses an improper access control vulnerability (CWE-284, CVSSv3 4.9) in FortiSOAR. An authenticated attacker with zero permissions can subscribe to websocket streams and topics and inject broadcast messages via crafted websocket requests. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 7d agoAdvisory

Cybersecurity jobs available right now: May 29, 2024

Help Net Security·Oct 15, 08:30 UTC · Oct 15, 2024Vulnerability

Fortinet enhances SecOps with cloud SOC, AI automation, and managed services

Help Net Security·Mar 10, 00:00 UTC · Mar 10, 2026Phishing & fraud

Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension

Fortinet patched 10 vulnerabilities including two critical authentication flaws, CVE-2026-84390 (CVSS 9.6) and CVE-2026-84388 (CVSS 9.1), in FortiMonitorOnSight and the FortiPAM Chrome extension.

Fortinet's September patch release fixes CVE-2026-84390, a sensitive-information issue in the FortiMonitorOnSight web portal that lets unauthenticated attackers bypass authentication with forged or reused JWTs. CVE-2026-84388 is an improper authentication flaw in the Fortinet Privileged Access Agent Chrome extension that can allow attackers to proxy a user's browser traffic via a malicious website, requiring upgrades to both FortiPAM 1.9.1/1.8.4 and extension 8.0.1.123+. High-severity information disclosure in FortiSandbox (CVE-2026-26084) and man-in-the-middle risk in the FortiOS/FortiProxy Agentless ZTNA portal (CVE-2026-84393) were also fixed, alongside medium/low issues across FortiManager, FortiAnalyzer, FortiSOAR, FortiClient, FortiSIEM and others. Fortinet did not indicate any of the flaws are being exploited in the wild.

SecurityWeek·Sep 9, 14:33 UTC · 6d agoVulnerability 2 sourcesCVE-2026-84390CVE-2026-84388CVE-2026-26084+1 CVEs

Fortinet FortiSOC unifies SIEM, SOAR, threat intelligence, and AI in one platform

Help Net Security·Jun 17, 00:00 UTC · Jun 17, 2026Threat actor

Fortinet expands GenAI capabilities across its portfolio with two new additions

Help Net Security·Nov 7, 00:00 UTC · Nov 7, 2024Vulnerability

Fortinet enhances Security Fabric with real-time response and automation capabilities

Help Net Security·Apr 5, 00:00 UTC · Apr 5, 2023Ransomware

FortiRecon gives enterprises adversary’s perspective of their attack surface

Help Net Security·Jun 7, 00:00 UTC · Jun 7, 2022Vulnerability