Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight Chrome Extension

Post Views: 5

Fortinet addressed multiple vulnerabilities across its product suite, including critical flaws in FortiMonitorOnSight and the Fortinet Privileged Access Agent Chrome extension.

Overview of Vulnerabilities

Fortinet released updates to resolve 10 security issues, with two classified as critical and others ranging from high to low severity. The most severe flaw, CVE-2026-84390, involves exposure of confidential data within source code for the FortiMonitorOnSight web portal. This vulnerability allows a remote, unauthenticated attacker to circumvent authentication mechanisms by manipulating forged or reused JSON Web Tokens (JWTs). A separate critical issue, CVE-2026-84388, affects the Fortinet Privileged Access Agent Chrome extension due to improper authentication controls. Exploitation could enable an attacker to intercept and relay user browser traffic if the victim navigates to a malicious site.

Critical Vulnerabilities

CVE-2026-84390

The flaw exposes confidential data within source code for the FortiMonitorOnSight web portal. A remote, unauthenticated attacker can bypass authentication by manipulating forged or reused JSON Web Tokens (JWTs).

CVE-2026-84388

This issue affects the Fortinet Privileged Access Agent Chrome extension due to improper authentication controls. Exploitation could allow an attacker to intercept and relay user browser traffic when visiting a malicious site.

High-Severity Flaws

FortiSandbox and ZTNA Portal

High-severity flaws were patched in FortiSandbox (CVE-2026-26084) and the FortiOS and FortiProxy Agentless ZTNA portal (CVE-2026-84393). These could enable unauthorized access to sensitive data and facilitate man-in-the-middle attacks.

Additional Vulnerabilities

Other vulnerabilities fixed include medium- and low-severity issues impacting FortiManager, FortiAnalyzer, FortiSandbox, FortiSOAR, FortiClient for Windows, FortiSIEM, FortiOS, FortiProxy, and FortiPAM. Exploitation could lead to bypassing approval processes, triggering denial-of-service conditions, executing arbitrary code, injecting broadcast messages, terminating processes, crashing the httpsd daemon, or redirecting users to malicious sites.

Remediation Steps

Fortinet emphasized that remediation requires simultaneous updates to FortiPAM and the Chrome extension. Users are advised to upgrade FortiPAM to version 1.9.1 or 1.8.4 and ensure the extension is at version 8.0.1.123 or higher.