CVE-2026-121528 · Vendor
NO FIX YET · SEE WHAT TO DO
FortiOS SSL VPN web portal does not properly validate certificates on its connection to the backend website. A remote, unauthenticated attacker positioned in the network path can perform a man-in-the-middle attack and read or alter traffic between the portal and the backend.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running FortiGate firewalls with FortiOS 7.2, 7.4 or 7.6 in the affected ranges that expose the SSL VPN web portal. The sources do not say whether a non-default configuration is needed, so treat any device in these ranges with SSL VPN enabled as potentially exposed.
Not affected if unknown
Who cares firewall, fortigate, fortios, ssl-vpn
7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.13.A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.