SSL-VPN Reflected XSS
CVSSv3 Score: 6.1 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS, FortiProxy, FortiPAM and FortiSwitch-Manager Agentless SSL-VPN may allow an authenticated remote user to execute code or commands via crafted requests. Revised on 2026-07-14 00:00:00
CSIRTS triage
- What
- An authenticated remote user may execute code or commands via crafted requests.
- Who is affected
- Authenticated remote users of FortiOS, FortiProxy, FortiPAM, and FortiSwitch-Manager.
- Urgency
- Remediation is important to prevent potential XSS attacks.
- Action
- Apply the latest patches for FortiOS, FortiProxy, FortiPAM, and FortiSwitch-Manager.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch FortiOS, FortiProxy, FortiPAM, FortiSwitch-Manager
Get an email when a new FortiOS, FortiProxy, FortiPAM, FortiSwitch-Manager advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-150
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-235730.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-23573 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from Fortinet FortiGuard PSIRT
- unknownOut of bounds read in GUI2026-07-14
- unknownHeader injection in captive portal authentication form2026-07-14
- unknownBuffer overread in authd and wad daemon2026-07-14
- unknownHeader injection in Web Filter warning page2026-07-14
- unknownStack Buffer Overflow in Log Report2026-07-14