FG-IR-26-150: SSL-VPN Reflected XSS
Published Jul 14, 2026
·Updated
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS, FortiProxy, FortiPAM and FortiSwitch-Manager Agentless SSL-VPN may allow an authenticated remote user to execute code or commands via crafted requests.
Affected Software
14 affected componentsFixes available
Fortinet FortiOS>=7.6.0<=7.6.6
Fortinet FortiOS>=7.4
Fortinet FortiOS>=7.2
Fortinet FortiPAM=.
Fortinet FortiPAM>=1.7
Fortinet FortiPAM>=1.6
Fortinet FortiPAM>=1.5
Fortinet FortiPAM>=1.4
Fortinet FortiPAM>=1.3
Fortinet FortiPAM>=1.2
Fortinet FortiPAM>=1.1
Fortinet FortiPAM>=1.0
Fortinet FortiProxy>=7.4.0<=7.4.3
Fortinet FortiProxy>=7.2.0<=7.2.9
Event History
Jul 14, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of FG-IR-26-150?
The severity of FG-IR-26-150 is medium, rated at 6.1.
2
How do I fix FG-IR-26-150?
To fix FG-IR-26-150, update your FortiOS, FortiProxy, FortiPAM, or FortiSwitch-Manager to the latest patched version.
3
What systems are affected by FG-IR-26-150?
FG-IR-26-150 affects Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitch-Manager Agentless SSL-VPN.
4
What type of vulnerability is FG-IR-26-150?
FG-IR-26-150 is a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input.
5
Can FG-IR-26-150 be exploited remotely?
Yes, FG-IR-26-150 can be exploited by an authenticated remote user via crafted requests.