What is CVE-2024-26006?

CVE-2024-26006 is a high-severity vulnerability in Fortinet Fortios, classified under Cross-site Scripting. CVSS score: 7.5/10. Published 2025-03-14.

How severe is CVE-2024-26006?

High severity. CVSS v3 base score is 7.5 out of 10.

XSS in Fortinet Fortios

CVE-2024-26006

An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below web SSL VPN UI may allow a remote unauthenticated attacker to perform a Cross-Site Scripting attack via a malicious samba server.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (43.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Fortinet Fortios — versions 7.4.0, 7.2.0, 7.0.0
Fortinet Fortiproxy — versions 7.4.0, 7.2.0, 7.0.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

psirt@fortinet.com (Vendor Advisory)

Frequently asked questions

What is CVE-2024-26006?: CVE-2024-26006 is a high-severity vulnerability in Fortinet Fortios, classified under Cross-site Scripting. CVSS score: 7.5/10. Published 2025-03-14.
How severe is CVE-2024-26006?: High severity. CVSS v3 base score is 7.5 out of 10.