FortiClient CORS flaw allows website-triggered RCE (CVE-2026-121529)
Fortinet says the CVSS 9.1 bug is not known exploited; fixes are 7.4.8 and 7.2.15, with no virtual patch.
1
Stories per day · 30 days
2 RSS
Relatedfortinet2authentication-bypass1cors1endpoint1forticlient1fortios1fortiproxy1remote-code-execution1ssh1
7 stories, newest first · one card per story
Stories tagged #fortipam
Fortinet sshd path traversal can bypass authentication without login
The CVSS 7.4 issue also covers FortiSASE, FortiProxy and FortiPam; the notice lists no versions or exploitation.
Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension
Fortinet patched 10 vulnerabilities including two critical authentication flaws, CVE-2026-84390 (CVSS 9.6) and CVE-2026-84388 (CVSS 9.1), in FortiMonitorOnSight and the FortiPAM Chrome extension.
3
Fortinet security advisory (AV26-898)
Canadian Cyber Centre advisory AV26-898 flags Fortinet vulnerabilities across FortiOS, FortiProxy, FortiPAM, FortiSandbox and FortiMonitorOnSight, urging administrators to apply updates
FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs
Fortinet patched CVE-2026-84388 (CVSS 9.1) in its FortiPAM Chrome extension, letting malicious websites alter proxy settings, open tabs and record sessions.
4
Null Pointer Dereference in Log Report
Fortinet patched a low-severity null pointer dereference (CVSS 2.5) in FortiOS, FortiProxy, and FortiPAM that lets authenticated attackers crash the httpsd daemon.
Improper Authentication of FortiPAM Server
Fortinet discloses CVSS 9.1 improper authentication in FortiPAM's Chrome extension allowing unauthenticated attackers to proxy victims' browser traffic.