CVEFinder.io

CVE-2026-23573

đŸ”ļ medium
Summary

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 t

Description

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9 may allow an authenticated remote user to execute code or commands via crafted requests.

CVSS Score
6.1
Medium
EPSS Score
0.3
Exploit Probability
Published Date
2026-07-14
First Seen: 2026-07-15
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 37.4% of all 365,890 vulnerabilities in our database.

#229,149
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Jul 14, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-08-11
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE IDs (Weakness Types)
CWE-79

đŸ“Ļ Affected Products 4

Vendor Product Status Affected Versions
fortinet fortios Affected
> 7.2.0 < 7.6.7
fortinet fortiproxy Affected
> 7.2.0 < 7.2.10
fortinet fortiproxy Affected
> 7.4.0 < 7.4.4
fortinet fortipam Affected
> 1.0.0 < 1.8.1

🔗 References 2

https://fortiguard.fortinet.com/psirt/FG-IR-26-150
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa...

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-71407 đŸ”ļ medium 5.6 0.5 A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an... 2026-08-12
CVE-2026-71408 đŸ”ļ medium 5.3 0.5 A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.... 2026-08-12
CVE-2025-43892 đŸ”ļ medium 4.3 0.4 A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all v... 2026-07-14
CVE-2025-62675 ℹī¸ low 3.4 0.3 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnera... 2026-07-14
CVE-2025-62826 ℹī¸ low 3.1 0.4 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnera... 2026-07-14
CVE-2026-59837 đŸ”ļ medium 6.6 0.7 A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM ... 2026-07-14
These CVEs affect the same products