FortinetCVE-2026-23573
Fortinet FortiOS: cross-site scripting
Medium6.1CVE-2026-23573 · Published Jul 14, 2026 · updated Aug 11, 2026
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9 may allow an authenticated remote user to execute code or commands via crafted requests.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| FortiOS Product | >= 7.6.0, <= 7.6.6 | No fix yet |
| >= 7.4.0, <= 7.4.12 | No fix yet | |
| >= 7.2.0, <= 7.2.13 | No fix yet | |
| >= 7.0.0, <= 7.0.19 | No fix yet | |
| FortiPAM Product | <= 1.8.0 | No fix yet |
| >= 1.7.0, <= 1.7.2 | No fix yet | |
| >= 1.6.0, <= 1.6.2 | No fix yet | |
| >= 1.5.0, <= 1.5.1 | No fix yet | |
| FortiProxy Product | >= 7.4.0, <= 7.4.3 | No fix yet |
| >= 7.2.0, <= 7.2.9 | No fix yet | |
| >= 7.0.0, <= 7.0.16 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-79
More Fortinet advisories
All Fortinet| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 14 | Fortinet FortiOS: path traversal | Medium5.5 | No fix yet |
| Jul 14 | Fortinet FortiOS: information disclosure | Medium4.3 | No fix yet |
| Jul 14 | Fortinet FortiSIEMWindowsAgent: privilege escalation | High7.5 | No fix yet |
| Jul 14 | Fortinet FortiSandbox: unauthenticated attacker could access the VNC server of... | High8.6 | No fix yet |
| Jul 14 | Fortinet FortiClientEMS: improper certificate validation | High7.5 | No fix yet |
| Jul 14 | Fortinet FortiOS: stack buffer overflow | Medium6.6 | No fix yet |