VDB
CVE-2026-23573
CVE-2026-23573
PUBLISHED
CVSS 6.1 MEDIUM
Reported by fortinet · Published July 14, 2026
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9 may allow an authenticated remote user to execute code or commands via crafted requests.
Risk Scores
CVSS 3.1
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiOS | 7.6.0, 7.4.0, 7.2.0 |
| Fortinet | FortiProxy | 7.4.0, 7.2.0, 7.0.0 |
| Fortinet | FortiPAM | 1.8.0, 1.7.0, 1.6.0 |
| Fortinet | FortiOS | 7.6.0, 7.4.0, 7.2.0 |
| Fortinet | FortiPAM | 1.0.0, 1.3.0, 1.2.0 |
| Fortinet | FortiProxy | 7.2.0, 7.0.0, 7.4.0 |
Timeline
- Jul 14, 2026 CVE Published
- Jul 14, 2026 CVE Updated
- Jul 14, 2026 Security Advisory
- Jul 15, 2026 Coalition ESS Score