CVE-2026-84393

This flaw is like a “wrong address” mistake in a device’s security check: it doesn’t properly verify that a certificate matches the host it’s talking to. If someone can reach your Fortinet device from the network, they may be able to trick it into revealing confidential information and potentially cause instability.

This matters if you operate Fortinet FortiOS or FortiProxy in the specific vulnerable version ranges: FortiOS 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6. Because it does not require authentication and is reachable in the default configuration, it’s relevant to businesses that expose these services to the network. The risk is highest when the device’s vulnerable network-facing services are reachable from the internet or other untrusted networks.

This is RED because the vulnerability is unauthenticated and network-reachable in default configuration, meaning an attacker can attempt it without logging in. While confirmed exploitation is not clearly reported in the findings, the ongoing press attention and the directness of the issue make it an immediate upgrade priority for exposed systems.

1. Identify affected versions:
   • On each Fortinet device, record the exact software version.
   • This CVE applies to FortiOS 7.6.1–7.6.6 and FortiProxy 7.6.2–7.6.6.
2. Confirm exposure (to prioritize):
   • Verify whether the device’s network-facing services that could accept incoming traffic are reachable from the internet or from any untrusted network segment.
   • Even though this is not tied to user logins, network reachability is what enables attempts.
3. Upgrade to the fixed versions (primary remediation):
   • FortiOS: upgrade to 7.6.7 or upgrade to 8.0.0 (or above).
   • FortiProxy: upgrade to 7.6.7 or upgrade to 8.0.0 (or above).
   • If you have multiple HA nodes, upgrade in a controlled order to maintain availability.
4. Workaround if patching is delayed (risk reduction):
   • Reduce exposure by firewalling and limiting inbound traffic to only required sources and ports.
   • Disable or restrict any non-essential internet-facing services.
   • Do not rely on “security through obscurity”; the vulnerability is reachable by network traffic.
5. What to monitor after changes:
   • Look for abnormal inbound connection attempts related to the Fortinet services (spikes in connection attempts or failed handshakes).
   • Review logs around the period before and after upgrades for repeated suspicious network patterns.
6. Timing note:
   • No CISA KEV listing was found in the provided findings, and no clearly dated exploitation report is included. Still, the configuration and authentication requirements make this worth acting on now.

CVE-2026-84393 is a CWE-297 (improper validation) issue specifically described as improper validation of a certificate with host mismatch. The findings indicate it is exploitable over the network without authentication and with no user interaction, and that it is reachable in default configuration. Impact is described as information disclosure (and potentially modification of integrity and/or availability impact) on the vulnerable device.

Exposure conditions from the findings:

• Target must be running FortiOS 7.6.1–7.6.6 or FortiProxy 7.6.2–7.6.6.
• Network access to the device’s relevant services is required; preconditions do not include logins.

Exploitation status indicators:

• KEV: not listed in the provided CISA KEV findings.
• Public exploit code: none noted.
• Real-world reporting: no clear dated claim in the provided news findings.
• EPSS is provided as a prediction, but per instructions it should not be used as a deciding factor in public-facing urgency.

Patch/remediation guidance from the provided findings:

• FortiOS: remediate by upgrading to 7.6.7 or 8.0.0 (or above).
• FortiProxy: remediate by upgrading to 7.6.7 or 8.0.0 (or above).