A critical improper authentication vulnerability, CVE-2026-84388, was identified recently in the Fortinet Privileged Access Agent Chrome extension. The vulnerability may allow a remote, unauthenticated attacker to proxy a user’s browser traffic through attacker-controlled servers if the user visits a malicious website. Successful exploitation could expose sensitive information transmitted through the affected browser session. System owners and users are strongly advised to update the affected components immediately to mitigate potential threats.

Vulnerability

• Fortinet Privileged Access Agent Improper Authentication Vulnerability (CVE-2026-84388)
  • Public Proof-of-Concept (PoC) has been released.

Severity Level

• Critical

Affected Versions

• FortiPAM versions prior to 1.9.1 in the 1.9 branch
• FortiPAM versions prior to 1.8.4 in the 1.8 branch
• Fortinet Privileged Access Agent Chrome extension versions prior to 8.0.1.123

Complete remediation requires coordinated updates to both FortiPAM and the browser extension. Updating only one of the two components may not fully address the vulnerability.

Remediation

• Upgrade FortiPAM to version 1.9.1, 1.8.4, or a later supported version.
• Update the Fortinet Privileged Access Agent Chrome extension to version 8.0.1.123 or later.
• Ensure that both components are updated to fully remediate the vulnerability.
• Users should avoid visiting suspicious or untrusted websites, particularly on browsers with the affected extension installed, until the updates have been applied.
• System administrators should review relevant browsers, proxy and privileged-session logs for suspicious traffic or connections to unknown servers.

Reference

• MITRE: CVE-2026-84388
• FortiGuard Labs: Improper Authentication of FortiPAM Server
• HKCERT: Fortinet Products Remote Code Execution Vulnerabilities
• SecurityWeek: Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension

Published on: 10 Sep 2026