CVE-2026-84388

Full vulnerability record from the local CVENow database.

Description

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions may allow attacker to information disclosure via remote unauthenticated attack

Severity

CRITICAL

CVSS score

9.6 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-09-22 15:17:18.950000

Last modified

2026-11-06 16:18:59.317000

View original CVE JSON

{
  "id": "CVE-2026-84388",
  "sourceIdentifier": "[email protected]",
  "published": "2026-09-22T15:17:18.950",
  "lastModified": "2026-11-06T16:18:59.317",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions may allow attacker to information disclosure via remote unauthenticated attack"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "FortiPAM Chrome Extension",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:fortinet:fortipam_chrome_extension:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortipam_chrome_extension:8.0.0:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "8.0.0",
              "lessThanOrEqual": "8.0.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-09-22T14:42:52.073466Z",
          "id": "CVE-2026-84388",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-168",
      "source": "[email protected]"
    }
  ]
}