Improper Certificate Validation in Fortinet FortiOS Affects VPN Security
CVE-2026-121528

7.7HIGH

Key Information:

Vendor

Fortinet
Status
FortiOS
Vendor
CVE Published:
11 November 2026

What is CVE-2026-121528?

An improper certificate validation issue is present in Fortinet FortiOS versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, and 7.2.0 through 7.2.13. This vulnerability allows remote, unauthenticated attackers to execute Man-in-the-Middle attacks. It can jeopardize the security of communications between the SSLVPN web portal and the backend destination website by enabling malicious actors to intercept or manipulate this critical data exchange. Organizations using affected versions should prioritize updating their systems to mitigate exposure to potential attacks.

Affected Version(s)

FortiOS 7.6.0 <= 7.6.4

FortiOS 7.4.0 <= 7.4.9

FortiOS 7.2.0 <= 7.2.13

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-193

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.