{"id":"CVE-2026-121528","kind":"vulnerability","aliases":["CVE-2026-121528"],"related":[],"title":"FortiOS: improper certificate validation lets attackers intercept SSL VPN portal traffic","description":"A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website.","summary":"FortiOS SSL VPN web portal does not properly validate certificates on its connection to the backend website. A remote, unauthenticated attacker positioned in the network path can perform a man-in-the-middle attack and read or alter traffic between the portal and the backend.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","fortigate","fortios","ssl-vpn","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the FortiOS version on the device against the affected ranges: `7.6.0` through `7.6.4`, `7.4.0` through `7.4.9`, `7.2.0` through `7.2.13`.\n- Confirm whether SSL VPN web portal is enabled on the device; the sources do not say which configuration is required.","fix":"- Fixed versions are not stated in the sources provided; check the Fortinet advisory for the fixed release in each branch.","status":"open","published_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","triaged_at":"2026-11-11T22:31:49+00:00","updated_at":"2026-11-11T22:31:49+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T22:31:49Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed versions are not stated in the sources provided; check the Fortinet advisory for the fixed release in each branch.","reach":"internet","title":"FortiOS: improper certificate validation lets attackers intercept SSL VPN portal traffic","impact":"medium","summary":"FortiOS SSL VPN web portal does not properly validate certificates on its connection to the backend website. A remote, unauthenticated attacker positioned in the network path can perform a man-in-the-middle attack and read or alter traffic between the portal and the backend.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortios","fortigate","ssl-vpn","firewall"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker intercepts and alters portal-to-backend traffic, exposing session data","analyst_note":"Find the fixed FortiOS versions per branch and whether SSL VPN portal configuration is required, from the Fortinet PSIRT advisory.","how_to_check":"- Check the FortiOS version on the device against the affected ranges: `7.6.0` through `7.6.4`, `7.4.0` through `7.4.9`, `7.2.0` through `7.2.13`.\n- Confirm whether SSL VPN web portal is enabled on the device; the sources do not say which configuration is required.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running FortiGate firewalls with FortiOS 7.2, 7.4 or 7.6 in the affected ranges that expose the SSL VPN web portal. The sources do not say whether a non-default configuration is needed, so treat any device in these ranges with SSL VPN enabled as potentially exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000786,"input_tokens":4604,"output_tokens":652,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121528':14A,17A '-2026':13A,16A '7.2.0':87C '7.2.13':89C '7.4.0':83C '7.4.9':85C '7.6.0':79C '7.6.4':81C 'allow':91C 'alter':63B 'attack':6A,45B,59B,96C,105C 'backend':40B,70B,117C 'certif':3A,34B,73C 'channel':109C 'communic':108C 'connect':37B 'cve':12A,15A 'destin':118C 'firewal':18B 'fortig':19B 'fortinet':77C 'fortio':1A,20B,25B,78C,82C,86C 'improp':2A,72C 'intercept':7A 'let':5A 'man':55B,101C 'man-in-the-middl':54B,100C 'may':90C 'middl':58B,104C 'network':49B 'path':50B 'perform':52B,98C 'portal':10A,29B,67B,114C 'posit':46B 'proper':32B 'read':61B 'remot':43B,93C 'ssl':8A,22B,26B 'ssl-vpn':21B 'sslvpn':112C 'traffic':11A,64B 'unauthent':44B,95C 'valid':4A,33B,74C 'vendor':24B 'vpn':9A,23B,27B 'vulner':75C 'web':28B,113C 'websit':41B,119C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiGate firewalls with FortiOS 7.2, 7.4 or 7.6 in the affected ranges that expose the SSL VPN web portal. The sources do not say whether a non-default configuration is needed, so treat any device in these ranges with SSL VPN enabled as potentially exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firewall","fortigate","fortios","high","sslvpn","vendor"],"campaign_type":null,"search_a":"'-121528':14A,17A '-2026':13A,16A 'attack':6A 'certif':3A 'cve':12A,15A 'fortio':1A 'improp':2A 'intercept':7A 'let':5A 'portal':10A 'ssl':8A 'traffic':11A 'valid':4A 'vpn':9A","search_b":"'alter':63B 'attack':45B,59B 'backend':40B,70B 'certif':34B 'connect':37B 'firewal':18B 'fortig':19B 'fortio':20B,25B 'man':55B 'man-in-the-middl':54B 'middl':58B 'network':49B 'path':50B 'perform':52B 'portal':29B,67B 'posit':46B 'proper':32B 'read':61B 'remot':43B 'ssl':22B,26B 'ssl-vpn':21B 'traffic':64B 'unauthent':44B 'valid':33B 'vendor':24B 'vpn':23B,27B 'web':28B 'websit':41B","search_c":"'7.2.0':87C '7.2.13':89C '7.4.0':83C '7.4.9':85C '7.6.0':79C '7.6.4':81C 'allow':91C 'attack':96C,105C 'backend':117C 'certif':73C 'channel':109C 'communic':108C 'destin':118C 'fortinet':77C 'fortio':78C,82C,86C 'improp':72C 'man':101C 'man-in-the-middl':100C 'may':90C 'middl':104C 'perform':98C 'portal':114C 'remot':93C 'sslvpn':112C 'unauthent':95C 'valid':74C 'vulner':75C 'web':113C 'websit':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121528","severity":null,"published_at":"2026-11-11T22:17:11+00:00","modified_at":"2026-11-11T22:17:11+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","fetched_at":"2026-11-11T22:29:27+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}