CVE-2026-84388: Critical severity Fortinet FortiPAM Chrome extension vulnerability
Published Sep 22, 2026
·Updated
A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack
Affected Software
1 affected component
Fortinet FortiPAM Chrome extension=8.0, =7.4
Event History
Sep 22, 2026
CVE Published
via MITRE·02:12 PM
Data Sourced
via MITRE·02:12 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
All versions in the FortiPAM Chrome Extension 8.0 and 7.4 release lines are affected.
2
Does exploitation require an authenticated account or prior access?
No. The issue is described as exploitable remotely by an unauthenticated attacker.
3
Is user interaction required for exploitation?
Yes. The supplied vector indicates that user interaction is required.
4
What impact can successful exploitation have?
Successful exploitation may result in information disclosure. The supplied severity vector also rates confidentiality and integrity impact as high and availability impact as low.