Description
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9 may allow an authenticated remote user to execute code or commands via crafted requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiOS | 7.6.0 – ≤ 7.6.6, 7.4.0 – ≤ 7.4.12, 7.2.0 – ≤ 7.2.13, 7.0.0 – ≤ 7.0.19, 6.4.0 – ≤ 6.4.16 | — |
| Fortinet | FortiProxy | 7.4.0 – ≤ 7.4.3, 7.2.0 – ≤ 7.2.9, 7.0.0 – ≤ 7.0.16 | — |
| Fortinet | FortiPAM | 1.8.0, 1.7.0 – ≤ 1.7.2, 1.6.0 – ≤ 1.6.2, 1.5.0 – ≤ 1.5.1, 1.4.0 – ≤ 1.4.3, 1.3.0 – ≤ 1.3.1, 1.2.0, 1.1.0 – ≤ 1.1.2, 1.0.0 – ≤ 1.0.3 | — |
Advisories 5
- SSA-127084 SSA-127084: Multiple Vulnerabilities in Fortigate NGFW before V7.6.7 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Nov 10, 2026
- ICSA-26-225-06 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · Aug 12, 2026
- NCSC-2026-0282 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Aug 11, 2026
- NCSC-2026-0240 Kwetsbaarheden verholpen in meerdere Fortinet producten NCSC-NL (Netherlands) · Jul 15, 2026
- WID-SEC-2026-2328 Fortinet FortiOS und FortiProxy: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 14, 2026