{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-84388", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-09-01T16:36:08.631Z", "datePublished": "2026-09-22T14:12:50.908Z", "dateUpdated": "2026-11-06T15:42:18.759Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiPAM Chrome Extension", "cpes": ["cpe:2.3:a:fortinet:fortipam_chrome_extension:8.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortipam_chrome_extension:8.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "8.0.0", "lessThanOrEqual": "8.0.1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions may allow attacker to information disclosure via remote unauthenticated attack"}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:18.759Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1021", "description": "Information disclosure", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L/E:P/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "Please refer to the Fortinet advisory for mitigation details."}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-168", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-168"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-22T14:42:52.073466Z", "id": "CVE-2026-84388", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-26T23:12:06.082Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-84388", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-22T14:42:52.073466Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T14:43:12.718Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L/E:P/RL:O/RC:C", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:2.3:a:fortinet:fortipam_chrome_extension:8.0.1:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiPAM Chrome Extension", "versions": [{"status": "affected", "version": "8.0.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please refer to the Fortinet advisory for mitigation details."}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-168", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-168"}], "descriptions": [{"lang": "en", "value": "A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1021", "description": "Information disclosure"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-09-22T14:12:50.908Z"}}}, "cveMetadata": {"cveId": "CVE-2026-84388", "state": "PUBLISHED", "dateUpdated": "2026-09-26T23:12:06.082Z", "dateReserved": "2026-09-01T16:36:08.631Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2026-09-22T14:12:50.908Z", "assignerShortName": "fortinet"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortipam_chrome_extension:8.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortipam_chrome_extension:8.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiPAM Chrome Extension", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "8.0.1", "status": "affected", "version": "8.0.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions may allow attacker to information disclosure via remote unauthenticated attack"}], "id": "CVE-2026-84388", "lastModified": "2026-11-06T16:18:59.317", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "psirt@fortinet.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-84388", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-22T14:42:52.073466Z", "version": "2.0.3"}}]}, "published": "2026-09-22T15:17:18.950", "references": [{"source": "psirt@fortinet.com", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-168"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1021"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.0.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "FortiPAM Chrome Extension", "source": "cna", "vendor": "Fortinet"}, "product": "fortipam_chrome_extension", "vendor": "fortinet"}], "created": "2026-09-22T17:00:12.797869+00:00", "updated": "2026-11-06T19:00:12.653478+00:00", "vendors": ["fortinet", "fortinet$PRODUCT$fortipam_chrome_extension"]}