Fortinet published two critical advisories on 8 September 2026. FG-IR-26-170 (CVE-2026-84390): the JWTs that authenticate the FortiMonitorOnSight web GUI are signed with a static key, an inclusion of sensitive information in source code flaw (CWE-540) that may let a remote unauthenticated attacker bypass authentication with a forged or reused JWT. FortiMonitorOnSight 7.2.0 to 7.2.2 and 7.2.4 to 7.2.7 are affected; the fix is 7.2.8 or above.

Fortinet found it internally. FG-IR-26-168 (CVE-2026-84388): an improper authentication flaw (CWE-287) in the Fortinet Privileged Access Agent Chrome extension may let a remote unauthenticated attacker proxy a user's browser traffic through attacker-controlled servers if the user visits a malicious website.

Fortinet says the fix needed coordinated changes in FortiPAM and the extension: to be fully secure, upgrade FortiPAM to 1.9.1 or 1.8.4 and make sure the Chrome extension is 8.0.1.123 or above; extension 7.4 users must migrate to a fixed release. Fortinet lists neither flaw as known exploited. Fortinet's advisories give CVSS 3 base scores of 9.8 and 9.6; its CVE records list 9.6 and 9.1.

The same day Fortinet also published FG-IR-26-166 (CVE-2026-26084, rated High), an improper access control flaw in the FortiSandbox web UI that may let an unauthenticated attacker access sensitive information, fixed in FortiSandbox 5.0.6 and 4.4.9 and in FortiSandbox Cloud and PaaS 5.0.6. (sources: Fortinet PSIRT advisories FG-IR-26-170, FG-IR-26-168 and FG-IR-26-166)

Correction (29 Oct 2026): the card relied on a SecurityWeek report, which is no longer linked; details that only it gave were removed.

The card now follows Fortinet's own advisories, published on 8 September (the card was dated 9 September), and gives Fortinet's advisory scores of 9.8 for CVE-2026-84390 and 9.6 for CVE-2026-84388 instead of the CVE-record figures of 9.6 and 9.1. (source: Fortinet PSIRT)