CVE-2026-23573 Overview
CVE-2026-23573 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Fortinet FortiOS, FortiProxy, and FortiPAM products. The flaw stems from improper neutralization of input during web page generation. An authenticated remote user can execute code or commands through crafted requests targeting the affected web interface. The vulnerability spans multiple versions across Fortinet's security appliance portfolio, including FortiOS 7.6.0 through 7.6.6, all FortiOS 7.4 and 7.2 versions, FortiPAM 1.0 through 1.8.0, and FortiProxy 7.2.0 through 7.4.3.
Critical Impact
An authenticated attacker can inject and execute malicious scripts in the context of a victim's browser session, potentially leading to session hijacking, credential theft, or unauthorized administrative actions on Fortinet security appliances.
Affected Products
- Fortinet FortiOS 7.6.0 through 7.6.6, 7.4 all versions, 7.2 all versions
- Fortinet FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.9
- Fortinet FortiPAM 1.0 through 1.8.0 (all versions)
Discovery Timeline
- 2026-07-14 - CVE CVE-2026-23573 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-23573
Vulnerability Analysis
The vulnerability resides in the web-based management interface of affected Fortinet products. The application fails to properly neutralize user-supplied input before including it in generated web pages. This classification aligns with [CWE-79], covering Improper Neutralization of Input During Web Page Generation.
The attack requires authentication but no elevated privileges. The scope is changed, meaning a successful exploit affects resources beyond the vulnerable component. User interaction is required, typically through a victim clicking a crafted link or loading a malicious page within an authenticated session.
Root Cause
The root cause is insufficient output encoding and input sanitization in one or more web page generation routines across FortiOS, FortiProxy, and FortiPAM. Input reflected into responses is not properly escaped for HTML, JavaScript, or attribute contexts. Attackers can craft requests containing script payloads that are rendered by the browser.
Attack Vector
Exploitation occurs over the network against the management interface. An authenticated attacker crafts a malicious request or link that, when processed, causes injected script content to execute in the browser of a targeted user. Because the vulnerable component is an administrative appliance, script execution in an administrator context can enable session token theft, forced configuration changes, or pivoting into protected network segments.
No verified public proof-of-concept code is currently available. Refer to the Fortinet Security Advisory FG-IR-26-150 for vendor technical details.
Detection Methods for CVE-2026-23573
Indicators of Compromise
- Unexpected HTTP requests to the FortiOS, FortiProxy, or FortiPAM administrative web interface containing HTML tags, JavaScript keywords, or URL-encoded script payloads.
- Administrator sessions exhibiting anomalous configuration changes shortly after clicking external links.
- Outbound network connections from administrator workstations to unfamiliar domains following management console access.
Detection Strategies
- Inspect web server and management interface logs for request parameters containing patterns such as <script, javascript:, onerror=, or encoded equivalents.
- Correlate administrator authentication events with subsequent configuration changes to identify session abuse.
- Deploy web application firewall rules that flag reflected input matching HTML or JavaScript syntax on Fortinet management endpoints.
Monitoring Recommendations
- Restrict access to Fortinet management interfaces to trusted administrative networks and monitor all access attempts.
- Enable and centrally collect administrative audit logs from FortiOS, FortiProxy, and FortiPAM for correlation.
- Alert on new or unusual browser user-agent strings accessing appliance management URLs.
How to Mitigate CVE-2026-23573
Immediate Actions Required
- Apply the fixed versions listed in the Fortinet Security Advisory FG-IR-26-150 as soon as feasible.
- Limit management interface exposure to dedicated administrative networks or VPN-only access.
- Require administrators to use isolated browsers or dedicated management workstations for appliance access.
Patch Information
Fortinet has published remediation guidance in Fortinet Security Advisory FG-IR-26-150. Administrators should consult the advisory for the specific fixed versions of FortiOS, FortiProxy, and FortiPAM applicable to their deployments and upgrade accordingly.
Workarounds
- Disable the HTTP/HTTPS administrative interface on untrusted network segments until patches are applied.
- Enforce trusted host restrictions on administrative accounts to limit which source addresses may authenticate.
- Educate administrators to avoid clicking untrusted links while authenticated to Fortinet management consoles.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
