Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension
Fortinet has released patches for ten critical vulnerabilities across its security products, including flaws in its FortiMonitorOnSight web portal and Chrome extension. These vulnerabilities could allow attackers to bypass authentication and potentially execute malicious code, highlighting a significant risk for organizations relying on Fortinet’s security solutions.
Fortinet released patches for ten vulnerabilities across its security products on Tuesday, addressing critical security defects. The first critical bug, CVE-2026-84390, is an inclusion of sensitive information in source code, affecting the FortiMonitorOnSight web portal. A remote, unauthenticated attacker could exploit this flaw to bypass authentication using a forged or reused JSON Web Token (JWT).
The second critical vulnerability is an improper authentication issue in the Fortinet Privileged Access Agent Chrome extension, tracked as CVE-2026-84388 (CVSS score of 9.1). A remote, unauthenticated attacker may exploit this security defect to proxy a user’s browser traffic if the user visits a malicious website.
Fortinet also patched high-severity bugs in FortiSandbox (CVE-2026-26084) and FortiOS and FortiProxy Agentless ZTNA portal (CVE-2026-84393) that could allow attackers to access sensitive information and perform man-in-the-middle (MitM) attacks, respectively.
The remaining vulnerabilities resolved on Tuesday are medium- and low-severity issues in FortiManager, FortiAnalyzer, FortiSandbox, FortiSOAR, FortiClient for Windows, FortiSIEM, FortiOS, FortiProxy, and FortiPAM. Successful exploitation of these flaws could allow attackers to bypass approval workflows, cause a denial-of-service (DoS) condition, execute arbitrary code, inject broadcast messages, terminate processes, crash the httpsd daemon, and cause redirections to arbitrary sites.
Fortinet states that no mention of these vulnerabilities being exploited in the wild has been made. Further details can be found on the company’s PSIRT advisories page.