Fortinet Critical Patches Target JWT Bypass and Browser Proxy

Fortinet's latest security bulletin brings fixes for a pair of critical vulnerabilities, one that could let attackers slip past authentication on a monitoring portal and another that might turn a Chrome extension into a conduit for hijacking a user's browser traffic. The patches, released Tuesday, address a total of 10 vulnerabilities, with the most severe carrying CVSS scores above 9.0.

The first critical issue, tracked as CVE-2026-84390, carries a CVSS score of 9.6. Fortinet describes it as an inclusion of sensitive information in source code affecting the FortiMonitorOnSight web portal. A remote, unauthenticated attacker could exploit this flaw to bypass authentication by using a forged or reused JSON Web Token (JWT).

At its core, the vulnerability essentially allows someone with network access to present a JWT that the portal trusts without proper verification. If an attacker crafts a token that the system accepts, they could gain access to the portal without valid credentials, potentially exposing whatever monitoring data and configuration information the portal holds. The improper handling of JWTs in the source code likely means that secret material used for token validation is exposed, making it possible for an attacker to forge tokens that appear legitimate.

Chrome Extension as a Proxy Risk

The second critical vulnerability, CVE-2026-84388, scores 9.1 and affects the Fortinet Privileged Access Agent Chrome extension. This one is described as an improper authentication issue. Fortinet warns that a remote, unauthenticated attacker may exploit the flaw to proxy a user's browser traffic if the user visits a malicious website.

What this means in practice is that a user who has the extension installed could be tricked into browsing to a page controlled by an attacker. That malicious page could then interact with the extension to route the user's traffic through an attacker-controlled proxy. The attacker could intercept sensitive data, such as credentials or session tokens, that the user transmits while browsing.

Fortinet did not provide technical specifics on how the attack is executed, but the vulnerability lies in the authentication mechanism of the extension. If the extension does not properly validate the origin of requests it receives, a malicious website could potentially send commands to it, exploiting its capabilities without authorization. In this case, the capability being abused is the ability to proxy browser traffic, which is a feature intended for legitimate privileged access management but becomes a dangerous tool in the hands of an attacker.

Coordinated Patching Required

One notable aspect of the Chrome extension vulnerability is the complexity involved in fixing it. Fortinet notes that remediation required coordinated changes in two components: FortiPAM and the Fortinet Privileged Access Agent Chrome extension. To be fully secure, customers should upgrade FortiPAM to 1.9.1 or 1.8.4, and ensure the Chrome extension is at version 8.0.1.123 or above.

This means that simply updating the extension is not enough; the server-side component, FortiPAM, also needs to be patched. Otherwise, the underlying issue may persist even with a newer extension version. Likewise, updating FortiPAM alone without updating the extension would leave the same risk unaddressed. This dual requirement adds a layer of operational complexity for administrators who must orchestrate updates across both components.

High-Severity Flaws Across Products

Beyond the two critical vulnerabilities, Fortinet patched high-severity bugs in other products. One affects FortiSandbox, tracked as CVE-2026-26084, which could allow attackers to access sensitive information. The other, CVE-2026-84393, impacts the FortiOS and FortiProxy Agentless ZTNA portal and could allow man-in-the-middle (MitM) attacks.

On the FortiOS and FortiProxy side, a man-in-the-middle attack would allow an attacker to intercept and potentially alter communications between a user and the ZTNA portal. That could lead to credential theft or session hijacking, depending on how the attack is executed. The FortiSandbox flaw, which involves access to sensitive information, might expose data that the sandboxing service handles, potentially revealing details about files that have been scanned or configuration settings.

Medium and Low Severity Fixes

The remaining vulnerabilities resolved on Tuesday are classified as medium- and low-severity issues. They span a wide range of Fortinet products, including FortiManager, FortiAnalyzer, FortiSandbox, FortiSOAR, FortiClient for Windows, FortiSIEM, FortiOS, FortiProxy, and FortiPAM.

Successful exploitation of these flaws could allow attackers to bypass approval workflows, cause a denial-of-service (DoS) condition, execute arbitrary code, inject broadcast messages, terminate processes, crash the httpsd daemon, and cause redirections to arbitrary sites. The breadth of potential impact highlights that even the lower-severity bugs can have significant consequences in specific environments.

For example, bypassing approval workflows could allow unauthorized configuration changes in FortiManager or FortiAnalyzer, while the ability to inject broadcast messages might enable phishing or other social engineering attacks on FortiClient. A denial-of-service condition could disrupt network operations, and arbitrary code execution on FortiSOAR could compromise automation workflows.

No Evidence of Active Exploitation

Fortinet makes no mention of any of these vulnerabilities being exploited in the wild. That is a positive sign, but it is not a guarantee that threat actors haven't reverse-engineered patches and begun developing exploits. Security teams should still prioritize applying the updates, particularly for the critical flaws that could allow remote, unauthenticated attacks.

Administrators should also consider that the two critical vulnerabilities are particularly serious because they require no user interaction beyond visiting a website in the case of the Chrome extension. The FortiMonitorOnSight flaw, being remotely exploitable without authentication, is also a high concern if the portal is exposed to the internet.

Key Details at a Glance

• Critical: CVE-2026-84390 (CVSS 9.6) – JWT bypass in FortiMonitorOnSight portal
• Critical: CVE-2026-84388 (CVSS 9.1) – Improper authentication in Fortinet Privileged Access Agent Chrome extension
• High: CVE-2026-26084 – Sensitive information access in FortiSandbox
• High: CVE-2026-84393 – MitM attack in FortiOS/FortiProxy Agentless ZTNA portal
• Total: 10 vulnerabilities patched in this round

Mitigation and Next Steps

Fortinet advises customers to upgrade FortiPAM to 1.9.1 or 1.8.4 and ensure the Chrome extension is at version 8.0.1.123 or above to address the critical Chrome extension flaw. For the other vulnerabilities, specific upgrade paths are available on the company's PSIRT advisories page, where detailed information on each issue and the corresponding fixed versions can be found.

Administrators should review their Fortinet deployments and determine which products are affected. Patching should be tested in a controlled environment first, especially for critical infrastructure, and then rolled out promptly. For the FortiMonitorOnSight vulnerability, organizations should check if the web portal is exposed to the internet and restrict access where possible.

Given the coordinated patch requirement for the Chrome extension, it is important to track both the FortiPAM and extension versions. In a large enterprise, that might require coordinating between teams that manage the server-side components and those responsible for endpoint software distribution.

Why It Matters

These patches underscore that even security products themselves can carry critical vulnerabilities, and the ones found in Fortinet's offerings are particularly concerning because they may be exploitable remotely without authentication. The fact that the FortiMonitorOnSight flaw allows authentication bypass via JWT is a reminder that organizations rely on strong authentication mechanisms to protect their monitoring and management interfaces. If an attacker can forge a JWT, they gain the same level of access as a legitimate user, which could lead to exposure of sensitive operational data or misuse of administrative functions.

The Chrome extension vulnerability highlights an increasingly common attack vector: browser extensions. As more security products move to the browser to provide visibility or control, they expand the attack surface that users carry with them to every website they visit. A malicious website targeting a vulnerable extension could turn it into a proxy, potentially compromising any data the user sends over the web. This incident suggests that organizations should treat browser-based security tools with the same scrutiny as any other network-attached software, ensuring these extensions are kept up to date and that users are aware of the risks of visiting untrusted sites.

While there is no evidence of in-the-wild exploitation yet, the severity of these vulnerabilities and the targeted nature of the products involved make it prudent for administrators to move quickly. Attackers often scan for vulnerable instances of popular security products, and patching is the only reliable defense.