← News
/DISPATCH · 2026-09-10

Fortinet September Batch Patches 10 Vulnerabilities: FortiMonitor Auth Bypass CVSS 9.6, ZTNA Portal Subject to MITM

Fortinet patches 10 vulnerabilities. FortiMonitorOnSight JWT auth bypass rated 9.6. FortiPAM Chrome extension can be hijacked as a traffic proxy. FortiSandbox has a 9.9 access-control flaw.

Fortinet released a batch security update on September 9, patching 10 vulnerabilities across multiple product lines. Two are directly exploitable by unauthenticated remote attackers. Most notable: FortiMonitorOnSight JWT authentication bypass (CVSS 9.6) and FortiPAM Chrome extension traffic-proxy flaw (CVSS 9.1). FortiSandbox also has a CVSS 9.9 access-control issue. Fortinet reports no evidence of in-the-wild exploitation.

Overview and Technical Details

FortiMonitorOnSight: JWT Authentication Bypass (CVE-2026-84390, CVSS 9.6)

Root cause: sensitive information exposed in the web portal source. A remote attacker with no account submits a forged JSON Web Token or replays a historical token the application still accepts, bypassing portal authentication and accessing protected functions. JWT security depends on signature verification and rejection of expired tokens; neither was implemented correctly.

FortiPAM Chrome Extension: Browser Traffic Proxy (CVE-2026-84388, CVSS 9.1)

Fortinet Privileged Access Agent browser extension has an inter-component authentication flaw. A user with the extension installed triggers it by visiting an attacker-controlled site—no prior authentication to Fortinet infrastructure. Browser traffic is proxied onto an attacker path, enabling traffic inspection, request tampering, and data manipulation. Fix requires both ends in sync: FortiPAM to 1.9.1 or 1.8.4, and the extension to 8.0.1.123 or later. Updating only one side is ineffective.

FortiSandbox: Improper Access Control (CVE-2026-26084, CVSS 9.9)

CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H shows network reachability, low complexity, no credentials or interaction, and scope changed—exploitation can cross the security boundary of the vulnerable component, with high impact on availability. Fortinet did not list specific affected and fixed versions in the high-level advisory. Admins must check the product-level PSIRT advisory for their deployment.

FortiOS/FortiProxy: Agentless ZTNA MITM (CVE-2026-84393)

The agentless ZTNA portal has improper certificate validation (CWE-295). An on-path attacker can use a forged certificate to conduct a man-in-the-middle attack between the portal and backend sites, intercepting sensitive traffic, viewing application data, or tampering with communications. Affects FortiOS and FortiProxy 7.6.1-7.6.6 / 7.6.2-7.6.6 branches. 7.2, 7.4, and 8.0 are unaffected.

Impact Assessment

ZTNA portals and privileged-access management components typically face the internet or low-trust networks. Flaws in the authentication path render traditional perimeter controls ineffective. Affected and fixed versions for FortiMonitorOnSight and FortiSandbox are not fully disclosed; enterprises with broad deployments should verify versions proactively rather than wait for a push.

Remediation

References