VulnSocial

CVE-2026-84390Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via <insert attack vector here>

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-540

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 9 mentions across 6 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 7 signals
  • Technical details provided in 7 signals
  • Disclosure: 3 classified signals
  • Peaked 4d ago at 3 mentions (2026-09-09); latest day: 1
  • 9 total mentions across 6 days

Deep dive

Activity timeline9 mentions / 6d
01223Mentions · 2026-09-08: 1Mentions · 2026-09-09: 3Mentions · 2026-09-10: 2Mentions · 2026-09-11: 1Mentions · 2026-09-13: 1Mentions · 2026-09-15: 1Patch / Workaround · 2026-09-08: 1Patch / Workaround · 2026-09-09: 3Patch / Workaround · 2026-09-10: 2Patch / Workaround · 2026-09-15: 1Technical Details · 2026-09-09: 3Technical Details · 2026-09-10: 2Technical Details · 2026-09-11: 1Technical Details · 2026-09-13: 109-0809-0909-1009-1109-1309-15
Signal classification2 categories
Patch
666.7%
Disclosure
333.3%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-09-081
Patch1
2026-09-093
Patch3
2026-09-102
Disclosure1Patch1
2026-09-111
Disclosure1
2026-09-131
Disclosure1
2026-09-151
Patch1
Full discourse9 posts
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🚨 Fortinet ürünlerinde kritik güvenlik açıkları! FortiMonitorOnSight ve Fortinet Privileged Access Agent'da kritik güvenlik açıkları tespit edildi: 🔴 CVE-2026-84390 — CVSS 9.6 FortiMonitorOnSight'ta kimlik doğrulama mekanizmasıyla ilgili kritik bir açık bulunuyor. Uzaktan, kimlik doğrulaması olmadan saldırı gerçekleştirilebildiği bildiriliyor. 🔴 CVE-2026-84388 — CVSS 9.1 Fortinet Privileged Access Agent'ı etkileyen açık, kötü amaçlı bir web sitesinin kullanıcı trafiğini saldırganın kontrolündeki bir proxy üzerinden yönlendirmesine yol açabiliyor. 📌 Her iki açık da Eylül 2026'da kamuoyuna duyuruldu. Fortinet'in yayımladığı güvenlik güncellemeleriyle sistemlerin güncellenmesi öneriliyor. https://fortiguard.fortinet.com/psirt/FG-IR-26-170 https://notcve.org/cve/CVE-2026-84388

    Post summary

    Fortinet has disclosed two critical vulnerabilities (CVE-2026-84390 and CVE-2026-84388) with high CVSS scores and recommends applying the available security updates.

    00032561
    2.4K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Fortinet fixed three critical Fortinet vulnerabilities. Attackers can exploit CVE-2026-84390 and CVE-2026-26084 to access corporate data. #Fortinet #Vulnerabilities #Cybersecurity #InfoSec #PatchManagement https://securityonline.info/fortinet-vulnerabilities-patch/ https://t.co/GAIAYjip34

    Post summary

    Fortinet has released patches for CVE‑2026‑84390 and CVE‑2026‑26084, with a referenced article detailing the fixes.

    01012451
    12.9K followersView on X
  • GovCERT.CZ@GOVCERT_CZ
    Patch

    🚨 Upozorňujeme na několik zranitelností v produktech Fortinet, CVE-2026-84388, CVE-2026-84390, CVE-2026-26084 a CVE-2026-84393. Zranitelnosti postihují FortiPAM Chrome Extension, FortiMonitor OnSight, FortiSandbox, FortiOS a FortiProxy a mohou neautentizovanému útočníkovi umožnit ovlivnit provoz prohlížeče při návštěvě škodlivého webu a přesměrovat jej přes infrastrukturu útočníka, obejít autentizaci pomocí podvržených nebo opakovaně použitých JWT tokenů, získat citlivé informace prostřednictvím speciálně vytvořených HTTP požadavků nebo provést útok typu man-in-the-middle, pokud se nachází na síťové trase mezi portálem Agentless ZTNA a backendovými weby. Úspěšné zneužití může vést k neoprávněnému přístupu, kompromitaci citlivých informací a odposlechu či manipulaci síťové komunikace. 📌Doporučujeme aktualizovat FortiPAM Chrome Extension 8.0 na verzi 8.0.1.123 nebo novější a u řady 7.4 přejít na opravenou verzi, FortiMonitor OnSight na verzi 7.2.8 nebo novější, FortiSandbox podle používané větve na verzi 4.4.9, 5.0.6 nebo 5.2.0 či novější, FortiSandbox Cloud a PaaS na verzi 5.0.6 nebo novější a FortiOS a FortiProxy na verzi 7.6.7 nebo novější, případně 8.0.0 nebo novější.

    Post summary

    The post reports on multiple Fortinet CVEs, describes the vulnerability vectors and adverse impact, and supplies explicit patch versions to mitigate the risk.

    10011869
    4.3K followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: Fortinet patches FortiMonitorOnSight CVE-2026-84390 (CVSS 9.6). Unauth attackers forge JWTs to skip login. Privileged Access Chrome agent CVE-2026-84388 (9.1) can proxy your browser if you visit a bad site. Update OnSight, FortiPAM 1.9.1 or 1.8.4, and the Chrome extension to 8.0.1.123+.

    Post summary

    Fortinet has released updates for FortiMonitorOnSight CVE-2026-84390 (CVSS 9.6) and Privileged Access Chrome agent CVE-2026-84388 (9.1), including detailed vulnerability descriptions and precise update instructions for the affected components.

    11010146
    3.0K followersView on X
  • NCIIPC India@NCIIPC
    Patch

    #Fortinet has released security update to address vulnerability in #FortiMonitorOnSight web portal. Apply update! #CVE-2026-84390 https://fortiguard.fortinet.com/psirt/FG-IR-26-170

    Post summary

    Fortinet released a security update addressing CVE-2026-84390 in FortiMonitorOnSight and urges users to apply the patch immediately.

    00010332
    8.5K followersView on X
  • Christopher Elliott@Chris_L_Elliott
    Patch

    Fortinet criticals today: FortiMonitorOnSight CVE-2026-84390 (9.6) - forged/reused JWT bypasses auth. Privileged Access Agent Chrome ext CVE-2026-84388 (9.1) - malicious site can proxy browser traffic. OnSight 7.2.8; ext 8.0.1.123+ + FortiPAM 1.9.1/1.8.4. https://www.securityweek.com/fortinet-patches-critical-vulnerabilities-in-fortimonitoronsight-chrome-extension/

    Post summary

    Fortinet released critical advisories for CVE‑2026‑84390 and CVE‑2026‑84388, detailing their high CVSS scores and affected product versions, and referenced patch availability via the linked article.

    01000106
    46 followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: Fortinet CVE-2026-84390 (CVSS 9.6) in FortiMonitorOnSight: unauth JWT forgery skips login. CVE-2026-84388 Chrome Privileged Access Agent can proxy traffic. Patch FortiPAM 1.9.1/1.8.4 + extension 8.0.1.123+. https://www.securityweek.com/fortinet-patches-critical-vulnerabilities-in-fortimonitoronsight-chrome-extension/

    Post summary

    Fortinet disclosed high‑CVSS vulnerabilities in FortiMonitorOnSight and Chrome Privileged Access Agent, and provided specific patches for FortiPAM and its extensions.

    01000149
    3.0K followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen CVE-2026-84390: Kritische Lücke in FortiMonitorOnSight 7.2.x legt sensible Daten im Quellcode offen #cve202684390 #fortimonitoronsight #fortinet #nvd https://cybersecurity-news.de/cve-2026-84390-fortimonitoronsight-schwachstelle

    Post summary

    A new vulnerability (CVE‑2026‑84390) affecting FortiMonitorOnSight 7.2.x is disclosed, noting sensitive data exposure in the source code, but no PoC, exploit, patch, or active exploitation is referenced.

    0000047
    12 followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    🚨 CRITICAL — CVE-2026-84390 A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, … CVSS 9.8 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-84390 #Fortinet #CyberSecurity #InfoSec

    Post summary

    CVE-2026-84390 is a high‑severity source‑code information disclosure affecting Fortinet FortiMonitorOnSight 7.2.4‑7.2.7, with CVSS 9.8 and no patch available yet; detailed analysis is linked on sec.kaitan.id.

    0000047
    88 followersView on X

Explore more

Back to dashboard