Fortinet Fixes Two Critical Security Flaws That Let Attackers Bypass Logins Entirely

Key points

• Fortinet patched 10 vulnerabilities on Tuesday, including two rated critical with scores of 9.6 and 9.1 out of 10.
• CVE-2026-84390 let an unauthenticated attacker break into the FortiMonitorOnSight web portal by forging a JWT, a digital identity token.
• CVE-2026-84388 let attackers silently route a user's browser traffic through their own server via the Fortinet Privileged Access Agent Chrome extension.
• Customers must update both FortiPAM and the Chrome extension to be fully protected; doing one without the other isn't enough.
• Fortinet says none of these flaws have been exploited in the wild yet.

Fortinet pushed out fixes for 10 security flaws on Tuesday. Two of them are critical. Neither required a password to exploit, and that detail matters more than the patch count.

How did the two critical flaws work?

Both bugs let strangers on the internet reach systems they had no business touching, without a login credential in sight.

The first, CVE-2026-84390, scored 9.6 out of 10 on the industry-standard severity scale. It lives inside FortiMonitorOnSight, a web portal used to monitor network health. Sensitive authentication secrets were baked into the application's source code. Anyone who found them could forge a JWT (JSON Web Token), essentially a digital visitor badge, and walk straight in. Our August story on a Cloudflare edge attack showed how quickly a JWT can be lifted once an attacker has the right foothold; here, the secrets were already sitting in plain sight.

The second, CVE-2026-84388, scored 9.1. It's an improper authentication flaw in the Fortinet Privileged Access Agent Chrome extension, used by IT staff to manage high-level system access from their browsers. If someone with the extension installed visited a malicious website, an attacker could quietly proxy all of that user's browser traffic through their own server. Every page visited, every credential typed: visible.

Fixing the second bug required updates to two separate components simultaneously. Customers need to upgrade FortiPAM (the server-side privileged access management system) to version 1.9.1 or 1.8.4 and ensure the Chrome extension is at version 8.0.1.123 or above. One without the other leaves the exposure open.

What else was in Tuesday's patch release?

Four other products got high-severity fixes. FortiSandbox, a tool for safely detonating suspicious files, received a patch for a flaw that could expose sensitive data. FortiOS and FortiProxy's agentless ZTNA portal got a fix for a man-in-the-middle vulnerability, where an attacker silently reads or alters traffic between two parties who think they're talking directly.

The remaining patches cover FortiManager, FortiAnalyzer, FortiSOAR, FortiClient for Windows, FortiSIEM, FortiOS, FortiProxy and FortiPAM. Successful exploitation of those lower-severity bugs could let attackers bypass approval workflows, cause service crashes or redirect users to fake websites.

Fortinet says none of these vulnerabilities are being actively exploited, first reported by SecurityWeek. That window tends to close fast once technical details are public.

Should ordinary employees be worried?

Not today, but IT teams running Fortinet software should treat this as urgent, not routine. The critical flaws need no password, no phishing email, no insider access. Network reachability to the right service is enough.

Check which versions you're running and update today. The coordinated two-component fix for CVE-2026-84388 is the one most likely to be missed.