Advisoriesby IbisFortinetCVE-2026-23573
Fortinet FortiOS: cross-site scripting
No fix yet
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9 may allow an authenticated remote user to execute code or commands via crafted requests.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| FortiOS Product | >= 7.6.0, <= 7.6.6 | No fix yet |
| >= 7.4.0, <= 7.4.12 | No fix yet | |
| >= 7.2.0, <= 7.2.13 | No fix yet | |
| >= 7.0.0, <= 7.0.19 | No fix yet | |
| FortiPAM Product | <= 1.8.0 | No fix yet |
| >= 1.7.0, <= 1.7.2 | No fix yet | |
| >= 1.6.0, <= 1.6.2 | No fix yet | |
| >= 1.5.0, <= 1.5.1 | No fix yet | |
| FortiProxy Product | >= 7.4.0, <= 7.4.3 | No fix yet |
| >= 7.2.0, <= 7.2.9 | No fix yet | |
| >= 7.0.0, <= 7.0.16 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-79