VulnSocial

CVE-2026-84388Patch

MEDIUM

Exploitation observed; activity peaked at 4 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

Back to dashboard
5.5/ 10 priority

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 11 mentions across 7 observed days

What's happening

  • Active exploitation reported across 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 6 signals
  • Technical details provided in 8 signals
  • Disclosure: 3 classified signals
  • General: 2 classified signals
  • Peaked 6d ago at 4 mentions (2026-09-09); latest day: 1
  • 11 total mentions across 7 days

Deep dive

Activity timeline11 mentions / 7d
01234Mentions · 2026-09-09: 4Mentions · 2026-09-10: 2Mentions · 2026-09-12: 1Mentions · 2026-09-22: 1Mentions · 2026-09-23: 1Mentions · 2026-09-24: 1Mentions · 2026-10-05: 1PoC Mentioned / Linked · 2026-09-23: 1Active Exploitation · 2026-09-12: 1Patch / Workaround · 2026-09-09: 3Patch / Workaround · 2026-09-10: 2Patch / Workaround · 2026-10-05: 1Technical Details · 2026-09-09: 3Technical Details · 2026-09-10: 2Technical Details · 2026-09-22: 1Technical Details · 2026-09-23: 1Technical Details · 2026-10-05: 109-0909-1009-1209-2209-2309-2410-05
Signal classification5 categories
Patch
436.4%
Disclosure
327.3%
General
218.2%
Active Exploitation
19.1%
PoC
19.1%
Referenced assets16 URLs
By indicator
Classification over time
DateTotalLabels
2026-09-094
Disclosure1General1Patch2
2026-09-102
Disclosure1Patch1
2026-09-121
Active Exploitation1
2026-09-221
Disclosure1
2026-09-231
PoC1
2026-09-241
General1
2026-10-051
Patch1
Full discourse11 posts
  • Mr. OS@ksg93rd
    Active Exploitation

    #Analytics #Threat_Research An analytical review of the main cybersecurity events (Sep 05-12, 2026) 1⃣ Sonicwall SMA1000 Attack https://hunt.io/blog/sonicwall-sma1000-uk-council-attack // CVE-2026-15409 2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://hunt.io/blog/sonicwall-sma1000-uk-council-attack 3⃣ Next Nightmare Eclipse Vulnerability https://github.com/MSNightmare/ShieldCrash/blob/main/README.md // Microsoft has failed to properly patch ShieldBreak CVE-2026-69414.. 4⃣ FortiPAM Vulnerability https://amibeingpwned.com/blog/fortinet-pam-vuln // CVE-2026-84388 5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel https://www.openwall.com/lists/oss-security/2026/09/08/1 // CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560,  CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274 6⃣ Netscaler ADC Exploit 7⃣ Critical vulnerabilities in MikroTik RouterOS https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ 8⃣ GRAYRABBIT One-click backdoor // One click. Three critical failures. One backdoor https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou 9⃣ Attacks using browser-in-browser (BiTB) phishing techniques https://www.huntress.com/blog/phishing-bitb-rmm-attacks 🔟 Beltdown: Escaping the Claude Code sandbox https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/ // An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user http://www.Geniebot.pro http://www.cyberpocket.org

    Post summary

    The bulletin summarizes recent vulnerability discoveries, with clear evidence of active exploitation for MikroTik RouterOS but lacking PoC details, exploit code, patches, or technical depth.

    01052601
    3.4K followersView on X
  • connect24h@connect24h
    General

    Fortinet拡張機能から通信を操作か。 この見出しは心臓に悪い。Fortinet Privileged Access Agentの名と、CVE-2026-84388へのリンク。ただ、提示本文には影響範囲や成立条件の記載がなく、見出しだけで危険度は決められない。元のCVEレコードで確かめたいのは、そこだ。 自分の現場に引き寄せると、管理対象の拡張機能を製品名だけで把握していないかが気になる。棚卸しで意味を持つのは、拡張機能IDと付与権限まで結びついた情報。導入を承認した記録はあっても、ブラウザに何を許したかまで答えられるだろうか。 https://www.cve.org/CVERecord?id=CVE-2026-84388

    Post summary

    The post merely notes the existence of CVE-2026-84388 in Fortinet's Privileged Access Agent, but gives no technical, exploit, or remediation details, nor evidence of active use.

    00052952
    8.9K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🚨 Fortinet ürünlerinde kritik güvenlik açıkları! FortiMonitorOnSight ve Fortinet Privileged Access Agent'da kritik güvenlik açıkları tespit edildi: 🔴 CVE-2026-84390 — CVSS 9.6 FortiMonitorOnSight'ta kimlik doğrulama mekanizmasıyla ilgili kritik bir açık bulunuyor. Uzaktan, kimlik doğrulaması olmadan saldırı gerçekleştirilebildiği bildiriliyor. 🔴 CVE-2026-84388 — CVSS 9.1 Fortinet Privileged Access Agent'ı etkileyen açık, kötü amaçlı bir web sitesinin kullanıcı trafiğini saldırganın kontrolündeki bir proxy üzerinden yönlendirmesine yol açabiliyor. 📌 Her iki açık da Eylül 2026'da kamuoyuna duyuruldu. Fortinet'in yayımladığı güvenlik güncellemeleriyle sistemlerin güncellenmesi öneriliyor. https://fortiguard.fortinet.com/psirt/FG-IR-26-170 https://notcve.org/cve/CVE-2026-84388

    Post summary

    Fortinet announced two critical CVEs (CVE‑2026‑84390 and CVE‑2026‑84388) with high CVSS scores, describing an authentication bypass in FortiMonitorOnSight and a proxy‑redirection flaw in Fortinet Privileged Access Agent, and advised users to install vendor security updates.

    00032561
    2.4K followersView on X
  • Cybersecurity News DE@cybsecuritynews
    General

    #schwachstellen Fortinet FortiPAM Chrome Extension: Kritische Schwachstelle CVE-2026-84388 offenbart Daten #cve202684388 #fortinet #fortipamchromeextension https://cybersecurity-news.de/fortinet-fortipam-chrome-extension-cve-2026-84388

    Post summary

    The tweet announces a critical vulnerability (CVE-2026-84388) in the Fortinet FortiPAM Chrome Extension that exposes data, linking to a news article for details, but provides no technical specifics, PoC, exploit code, patch information, or evidence of active exploitation.

    1002068
    17 followersView on X
  • GovCERT.CZ@GOVCERT_CZ
    Patch

    🚨 Upozorňujeme na několik zranitelností v produktech Fortinet, CVE-2026-84388, CVE-2026-84390, CVE-2026-26084 a CVE-2026-84393. Zranitelnosti postihují FortiPAM Chrome Extension, FortiMonitor OnSight, FortiSandbox, FortiOS a FortiProxy a mohou neautentizovanému útočníkovi umožnit ovlivnit provoz prohlížeče při návštěvě škodlivého webu a přesměrovat jej přes infrastrukturu útočníka, obejít autentizaci pomocí podvržených nebo opakovaně použitých JWT tokenů, získat citlivé informace prostřednictvím speciálně vytvořených HTTP požadavků nebo provést útok typu man-in-the-middle, pokud se nachází na síťové trase mezi portálem Agentless ZTNA a backendovými weby. Úspěšné zneužití může vést k neoprávněnému přístupu, kompromitaci citlivých informací a odposlechu či manipulaci síťové komunikace. 📌Doporučujeme aktualizovat FortiPAM Chrome Extension 8.0 na verzi 8.0.1.123 nebo novější a u řady 7.4 přejít na opravenou verzi, FortiMonitor OnSight na verzi 7.2.8 nebo novější, FortiSandbox podle používané větve na verzi 4.4.9, 5.0.6 nebo 5.2.0 či novější, FortiSandbox Cloud a PaaS na verzi 5.0.6 nebo novější a FortiOS a FortiProxy na verzi 7.6.7 nebo novější, případně 8.0.0 nebo novější.

    Post summary

    Fortinet issues a patch advisory for multiple CVEs affecting several products, describing the vulnerability and recommending firmware updates; no active exploitation or PoC is provided.

    10011869
    4.3K followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: Fortinet patches FortiMonitorOnSight CVE-2026-84390 (CVSS 9.6). Unauth attackers forge JWTs to skip login. Privileged Access Chrome agent CVE-2026-84388 (9.1) can proxy your browser if you visit a bad site. Update OnSight, FortiPAM 1.9.1 or 1.8.4, and the Chrome extension to 8.0.1.123+.

    Post summary

    Fortinet has released patches for CVE‑2026‑84390 and CVE‑2026‑84388, detailing how unauthorized attackers can forge JWTs to bypass authentication and proxy browser traffic, and provides specific version upgrades to mitigate the risks.

    11010146
    3.0K followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    🚨 CRITICAL — CVE-2026-84388 A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all vers… CVSS 9.6 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-84388 #Fortinet #CyberSecurity #InfoSec

    Post summary

    The text announces a new critical vulnerability (CVE-2026-84382) in Fortinet FortiPAM Chrome Extension with technical details and CVSS score, but no patch or active exploitation indicators.

    1001079
    90 followersView on X
  • Christopher Elliott@Chris_L_Elliott
    Disclosure

    Fortinet criticals today: FortiMonitorOnSight CVE-2026-84390 (9.6) - forged/reused JWT bypasses auth. Privileged Access Agent Chrome ext CVE-2026-84388 (9.1) - malicious site can proxy browser traffic. OnSight 7.2.8; ext 8.0.1.123+ + FortiPAM 1.9.1/1.8.4. https://www.securityweek.com/fortinet-patches-critical-vulnerabilities-in-fortimonitoronsight-chrome-extension/

    Post summary

    Fortinet disclosed two critical vulnerabilities: CVE-2026-84390, where forged JWTs bypass authentication in FortiMonitorOnSight, and CVE-2026-84388, allowing a malicious site to proxy browser traffic via the privileged access agent Chrome extension, with patched versions identified.

    01000106
    46 followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: Fortinet CVE-2026-84390 (CVSS 9.6) in FortiMonitorOnSight: unauth JWT forgery skips login. CVE-2026-84388 Chrome Privileged Access Agent can proxy traffic. Patch FortiPAM 1.9.1/1.8.4 + extension 8.0.1.123+. https://www.securityweek.com/fortinet-patches-critical-vulnerabilities-in-fortimonitoronsight-chrome-extension/

    Post summary

    The news article informs readers that Fortinet issued patches for high‑impact CVEs (CVE‑2026‑84390/84388) affecting FortiMonitorOnSight and Chrome Privileged Access Agent, detailing the required FortiPAM and extension updates.

    01000149
    3.0K followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 CRITICAL: CVE-2026-84388 (CVSS 9.6) Fortinet FortiPAM Chrome Extension v7.4 & 8.0 vulnerable to UI layer restriction bypass. Remote unauthenticated attackers can exploit for information disclosure. Update immediately. #CVE #Vulnerability #PatchNow https://t.co/xJgmWLr970

    Post summary

    The tweet reports a critical UI restriction bypass in FortiPAM Chrome Extension versions 7.4 and 8.0 that could allow remote unauthenticated information disclosure, and urges immediate updating to apply the patch.

    0000052
    147 followersView on X
  • Pumpkin Security@PumpkinSecurity
    PoC

    @KaitanSecurity @KaitanSecurity A UI-layer isolation bug can still be crucial, as demonstrated by FortiPAM Chrome Extension 8.0. Inventory the extension and treat rendered frames as an attack surface because CVE-2026-84388 is CVSS 9.6 without a patch.

    Post summary

    The tweet highlights CVE-2026-84388 as a UI-layer isolation bug (CVSS 9.6) demonstrated via the FortiPAM Chrome Extension 8.0, with no patch available.

    0000037
    55 followersView on X

Explore more

Back to dashboard