CVE-2026-84388
Received Received - Intake

Improper UI Layer Restriction in Fortinet FortiPAM Chrome Extension

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Fortinet, Inc.

Description
A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-84388
EUVD
EUVD-2026-84423

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fortinet fortipam_chrome_extension 8.0
fortinet fortipam_chrome_extension 7.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1021 The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper restriction of rendered UI layers or frames in Fortinet FortiPAM Chrome Extension versions 8.0 and 7.4. It allows an attacker to disclose information remotely without authentication by exploiting how the extension renders UI elements.

Impact Analysis

This vulnerability may allow attackers to access sensitive information displayed in the extension's UI. Since it requires no authentication, any user with access to the affected extension could be at risk of information disclosure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR or HIPAA. Organizations using the affected extension may face legal and regulatory penalties due to potential data breaches.

Mitigation Strategies

Immediately uninstall or disable the FortiPAM Chrome Extension versions 8.0 and 7.4 to prevent potential information disclosure via remote unauthenticated attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84388. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart