Fortinet Fixes Two Critical Security Flaws That Let Attackers Bypass Logins Entirely

Key points

• Fortinet patched 10 vulnerabilities on Tuesday, including two rated critical with scores of 9.6 and 9.1 out of 10.
• CVE-2026-84390 let an attacker break into the FortiMonitorOnSight web portal without a password by forging a digital identity token.
• CVE-2026-84388 allowed attackers to secretly intercept a user's browser traffic through a malicious website, using the Fortinet Privileged Access Agent Chrome extension.
• Customers must update both FortiPAM (a privileged access management product) and the Chrome extension to be fully protected.
• Fortinet says none of these flaws have been exploited in the wild yet.

Fortinet, the network security company whose products guard corporate and government networks worldwide, pushed out fixes for 10 security flaws on Tuesday. Two of them are serious enough to earn the label "critical."

Neither required a password to exploit. That detail matters.

How did the two critical flaws work?

Both bugs let strangers on the internet access systems they should never have been able to touch, without knowing anyone's login credentials.

The first, CVE-2026-84390, scored 9.6 out of 10 on the standard severity scale used across the industry. It lives inside FortiMonitorOnSight, a web portal used to monitor network health. The flaw comes down to a rookie-level mistake: sensitive authentication secrets were baked into the application's source code, the underlying instructions the software runs on. Anyone who found those secrets could forge a JWT, which stands for JSON Web Token. Think of a JWT as a digital visitor badge. Forge one convincingly, and the front door opens.

The second critical bug, CVE-2026-84388, scored 9.1. It affects a Chrome browser extension called the Fortinet Privileged Access Agent, which is used by IT staff to manage high-level system access from their browsers. If a user with the extension installed visited a booby-trapped website, an attacker could quietly route, or "proxy," all of that user's browser traffic through their own server. Every page visited, every credential typed: visible.

Fortinet says fixing the second bug required updates to two separate pieces of software at the same time. Customers need to upgrade FortiPAM (the server-side privileged access management system) to version 1.9.1 or 1.8.4, and separately make sure the Chrome extension is updated to version 8.0.1.123 or above. Doing one without the other leaves the door open.

What else was in Tuesday's patch release?

Four other products received high-severity fixes. FortiSandbox, a tool for safely detonating suspicious files, and Fortinet's FortiOS and FortiProxy products both got patches covering issues that could expose sensitive data or allow a man-in-the-middle attack, where a criminal silently reads or alters traffic between two parties who think they are talking directly.

The remaining fixes cover a long list of Fortinet products, including FortiManager, FortiAnalyzer, FortiSOAR, FortiClient for Windows, FortiSIEM, and FortiPAM. The lower-severity bugs could still let attackers crash services, run unauthorized code, or redirect users to fake websites.

Fortinet says none of these vulnerabilities are being actively exploited, first reported by SecurityWeek. That window can close fast once details are public.

Should ordinary employees be worried?

Not today, but IT teams at any organisation running Fortinet software should treat this as urgent, not routine. The critical flaws require no password, no phishing email, no insider help. An attacker just needs network access to the right service.

If you work in IT and your organisation uses any of the products above: check which versions you are running and update today.