CVE-2026-84393

Awaiting Analysis Awaiting Analysis - Queue

Host Mismatch Certificate Validation in Fortinet FortiOS

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: Fortinet, Inc.

Description

A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via <insert attack vector here>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-84393

Affected Vendors & Products

Vendor	Product	Version / Range
fortinet	fortios	From 7.6.1 (inc) to 7.6.6 (inc)
fortinet	fortiproxy	From 7.6.2 (inc) to 7.6.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-297	The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper validation of SSL/TLS certificates with host mismatch in Fortinet FortiOS and FortiProxy. It allows an attacker to potentially access sensitive information due to weak certificate validation.

Impact Analysis

An attacker could exploit this to intercept sensitive data transmitted over encrypted connections, leading to information disclosure. This may include credentials, personal data, or other confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and encryption. Non-compliance may result in legal penalties.

Mitigation Strategies

Upgrade FortiOS to a version beyond 7.6.6 and FortiProxy to a version beyond 7.6.6 to address the certificate validation issue. Apply patches as soon as they are available from Fortinet.

Hi! I’m here to help you understand CVE-2026-84393. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70