{"id":"CVE-2026-84388","state":"PUBLISHED","title":"A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow at","description":"A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack","publishedAt":"2026-09-22T14:12:50.908Z","updatedAt":"2026-09-26T23:12:06.082Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L/E:P/RL:O/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiPAM Chrome Extension"],"affected":[{"vendor":"Fortinet","product":"FortiPAM Chrome Extension","defaultStatus":"unaffected","versions":[{"version":"8.0.1","status":"affected"}],"cpes":["cpe:2.3:a:fortinet:fortipam_chrome_extension:8.0.1:*:*:*:*:*:*:*"]}],"references":["https://fortiguard.fortinet.com/psirt/FG-IR-26-168"],"weaknesses":["CWE-1021"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/84xxx/CVE-2026-84388.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-84388","state":"PUBLISHED","datePublished":"2026-09-22T14:12:50.908Z","dateUpdated":"2026-09-26T23:12:06.082Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2026-09-01T16:36:08.631Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack"}],"affected":[{"vendor":"Fortinet","product":"FortiPAM Chrome Extension","defaultStatus":"unaffected","versions":[{"version":"8.0.1","status":"affected"}],"cpes":["cpe:2.3:a:fortinet:fortipam_chrome_extension:8.0.1:*:*:*:*:*:*:*"]}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-168","name":"https://fortiguard.fortinet.com/psirt/FG-IR-26-168"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L/E:P/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1021","lang":"en","description":"Information disclosure","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2026-09-22T14:12:50.908Z"},"solutions":[{"lang":"en","value":"Please refer to the Fortinet advisory for mitigation details."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-22T14:42:52.073466Z","id":"CVE-2026-84388","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-26T23:12:06.082Z"}}]}}}