UpHeron
All vulnerabilities

Servers and applications

CVE-2026-121528

A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website.

Severity
High 7.7
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Improper certificate validation (CWE-295)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Sources
CVE Program

Affected software

SoftwareAffected versions
Fortinet FortiOSServers and applications · cna:fortinet|fortios
  • From 6.4.0 up to 6.4.16
  • From 7.0.0 up to 7.0.19
  • From 7.2.0 up to 7.2.13
  • From 7.4.0 up to 7.4.9
  • From 7.6.0 up to 7.6.4
Fortinet FortiOSServers and applications · cpe:o:fortinet:fortios
  • From 6.4.0 up to 6.4.16
  • From 7.0.0 up to 7.0.19
  • From 7.2.0 up to 7.2.13
  • From 7.4.0 up to 7.4.9
  • From 7.6.0 up to 7.6.4

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-121528