CVE-2026-84390

criticalpriority · track · 0EPSS 0.005 · 44 %ileNLRU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.52% (44th) EPSS

CVSS 9.8 · critical

Is it mine?

20 products

Check your exposure

Who says so?

2 sources

fstec_bdu · ncsc_nl

EPSS · scored 2026-10-26

A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via <insert attack vector here>

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · psirt@fortinet.comexploitability 3.9 · impact 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:Csecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-540USprimaryCWE-540US

affected products (20)

Products and version ranges known to be affected.

Fortinet Inc. FortiMonitorOnSight7.2.0 → 7.2.8fstec_bduRU
Fortinet Inc. FortiMonitorOnSight7.2.4 → 7.2.8fstec_bduRU
Fortinet FortiAnalyzer≤ vers:unknown/*ncsc_nlNL
Fortinet FortiClientWindows≤ vers:unknown/*ncsc_nlNL
Fortinet FortiManager≤ vers:unknown/*ncsc_nlNL
Fortinet FortiManager Cloud≤ vers:unknown/*ncsc_nlNL
Fortinet FortiMonitor≤ vers:unknown/*ncsc_nlNL
Fortinet FortiMonitor OnSight≤ vers:unknown/*ncsc_nlNL
Fortinet FortiOS≤ vers:unknown/*ncsc_nlNL
Fortinet FortiPAM≤ vers:unknown/*ncsc_nlNL
Fortinet FortiProxy≤ vers:unknown/*ncsc_nlNL
Fortinet FortiSIEM≤ vers:unknown/*ncsc_nlNL
Fortinet FortiSOAR PaaS≤ vers:unknown/*ncsc_nlNL
Fortinet FortiSOAR on-premise≤ vers:unknown/*ncsc_nlNL
Fortinet FortiSandbox≤ vers:unknown/*ncsc_nlNL
Fortinet FortiSandbox Cloud≤ vers:unknown/*ncsc_nlNL
Fortinet FortiSandbox PaaS≤ vers:unknown/*ncsc_nlNL
Fortinet Fortimonitor_Onsight≤ vers:unknown/*ncsc_nlNL
fortinet FortiMonitorOnSight≤ vers:unknown/*ncsc_nlNL
fortinet FortiPAM Chrome Extension≤ vers:unknown/*ncsc_nlNL

advisories (1)

Vendor and ecosystem advisories describing this.

NCSC-2026-0355Kwetsbaarheden verholpen in Fortinet Forti-productenNL2026-09-09csaf · ncsc_nlNL
Fortinet heeft kwetsbaarheden verholpen in FortiAnalyzer, FortiOS, FortiPAM, FortiProxy, FortiSandbox, FortiManager, FortiManager Cloud, FortiMonitorOnSight, FortiClient Windows, FortiSIEM en FortiSOAR.

also known as (1)

Other names and identifiers for this entity.

BDU:2026-14983 fstec_bdu

sources

Which sources assert this record, and when.

fstec_bdu ncsc_nl NVD CVE.org MITRE

published 2026-09-11modified 2026-09-21

related (37)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2019-10849US	high7.5OT elevated	9.01% (95th)	Exploit	2019-05-23
Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.
CVE-2024-38327US	critical9.8	0.33% (25th)	—	2025-07-10
IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 is vulnerable to information exposure and further attacks due to an exposed JavaScript source map which could assist an attacker to…
CVE-2025-49182US	critical9.8	0.55% (46th)	—	2025-06-12
Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application.
CVE-2024-8417US	high8.1	0.73% (54th)	—	2024-09-04
A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 1.5.5. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/educ…
CVE-2024-38647US	high7.5	0.65% (51st)	—	2024-11-22
An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to compromise the security…

+32 more

references (1) nvd

External citations — patches, advisories, analysis.

https://fortiguard.fortinet.com/psirt/FG-IR-26-170

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan