Vulnerabilities
FortiOS & FortiProxy Agentless ZTNA Portal Certificate Validation Flaw Enables MITM
Fortinet disclosed a CVSS 7.3 certificate validation flaw in FortiOS and FortiProxy Agentless ZTNA portal that allows unauthenticated attackers to perform MITM between the portal and backend sites. The vulnerability (CWE‑295) can be exploited remotely without credentials. Immediate patching and enforcement of strict TLS validation is required.
What happened
Fortinet identified an improper certificate validation issue (CWE‑295) in FortiOS and the FortiProxy Agentless ZTNA portal. The flaw allows a remote, unauthenticated attacker to intercept traffic between the ZTNA portal and its backend destination website.
Impact
Attackers can conduct a man‑in‑the‑middle (MITM) attack, capturing or modifying data exchanged with backend services. The vulnerability is exploitable without authentication and has a CVSS v3 score of 7.3.
Mitigation
- Apply the latest FortiOS and FortiProxy firmware updates that address the certificate validation issue.
- Configure the ZTNA portal to enforce strict TLS certificate validation and reject self‑signed or untrusted certificates.
- Verify that backend services present valid, trusted certificates and that the portal’s trust store is up‑to‑date.
- Enable logging of TLS handshake failures and monitor for anomalous traffic patterns.
Next steps
Ensure all FortiOS and FortiProxy devices are running patched versions and that certificate validation is enabled before re‑introducing the ZTNA portal into production.
Related vulnerabilities
FortiOS/Proxy/PAM Trusted Host Bypass via SSH CLI
An authenticated admin can bypass the trusted host policy on FortiOS, FortiProxy, and FortiPAM using a crafted SSH command. The flaw is a low‑severity privilege‑management issue (CWE-269). Defenders should patch and harden SSH access.
Read briefing
FortiOS SSL‑VPN RCE (CVE‑2024‑21762): Public Exploits, Patch Now
Fortinet’s FortiOS and FortiProxy software suffer a critical unauthenticated remote‑code‑execution flaw in the SSL‑VPN. Public exploit code and active attacks have been observed, with CISA confirming real‑world exploitation. Affected versions span FortiOS 6.0‑7.4.x and multiple FortiProxy releases. Apply the vendor patch immediately; if that’s not possible, disable the SSL‑VPN interface as a temporary stopgap.
Read briefing
Cisco Secure Email Gateway Vulnerability Enables Remote Root Execution
A critical flaw (CVE-2026-76461) in Cisco AsyncOS Email Gateway allows unauthenticated remote attackers to execute commands as root. The issue stems from insufficient email parsing validation and is actively exploited. Defenders should patch immediately and monitor for anomalous activity.
Read briefing
Cisco Crosswork Network Controller Vulnerability Enables Remote Command Execution via Template Injection
A server‑side template injection flaw in Cisco Crosswork Network Controller’s web interface allows authenticated users with write‑privileged template accounts to run arbitrary OS commands on the device. The issue is caused by insufficient input validation in the configuration template engine. Cisco has released patches; no workaround exists. The flaw is rated Medium and carries CVE‑2026‑20220.
Read briefing