# CVE-2026-23573: Fortinet FortiOS and FortiProxy reflected XSS in Agentless SSL-VPN

Source: https://junglewise.ai/threats/cve-2026-23573-fortinet-fortios-and-fortiproxy-reflected-xss-in-agentless-ssl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-23573 · Severity: medium · CVSS 6.1 · Published 2026-07-14

A security vulnerability exists in the Agentless SSL-VPN feature of several Fortinet products, including FortiOS and FortiProxy. This feature allows users to access internal resources through a web browser without installing additional software. An attacker could exploit this flaw to execute malicious scripts in a user's browser session, potentially leading to unauthorized actions or the theft of sensitive session information.

Technologies: [Fortinet FortiOS](https://junglewise.ai/threats/technologies/fortios), [Fortinet Fortipam](https://junglewise.ai/threats/technologies/fortipam), [Fortinet FortiProxy](https://junglewise.ai/threats/technologies/fortiproxy). Vendors: [Fortinet](https://junglewise.ai/threats/vendors/fortinet).

## Quick answers

**Is CVE-2026-23573 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23573 being exploited in the wild.

**How severe is CVE-2026-23573?** Medium severity, with a CVSS score of 6.1, published 14 July 2026.

**Which products and versions are affected?** Fortinet FortiOS 7.6.0 through 7.6.6, 7.4 all versions, 7.2 all versions; Fortinet Fortipam 1.8.0, 1.7 all versions, 1.6 all versions, 1.5 all versions, 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; Fortinet FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.9; Fortinet FortiSwitch-Manager All versions using Agentless SSL-VPN.

**Is there a fix for CVE-2026-23573?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-23573 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-23573?** Check whether you run Fortinet FortiOS, Fortinet Fortipam, Fortinet FortiProxy or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] exists in the Agentless SSL-VPN component of multiple Fortinet products. The flaw is a reflected XSS that occurs when the application fails to properly sanitize user-supplied input before including it in a web page. An unauthenticated remote attacker can exploit this by tricking a user into clicking a specially crafted link, allowing the execution of arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking or unauthorized command execution. The vulnerability only impacts systems where the Agentless SSL-VPN feature is enabled.

## Affected products

- Fortinet FortiOS 7.6.0 through 7.6.6, 7.4 all versions, 7.2 all versions
- Fortinet FortiPAM 1.8.0, 1.7 all versions, 1.6 all versions, 1.5 all versions, 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions
- Fortinet FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.9
- Fortinet FortiSwitch-Manager All versions using Agentless SSL-VPN

## Timeline

- 2026-07-14: advisory: Initial publication by Fortinet
- 2026-07-14: disclosed: Reported by the UK's National Cyber Security Centre (NCSC)

## References

- [https://fortiguard.fortinet.com/psirt/FG-IR-26-150](https://fortiguard.fortinet.com/psirt/FG-IR-26-150)

## Related threats

- [Fortinet FortiOS authentication bypass in HA command execution](https://junglewise.ai/threats/cve-2026-126259-a-missing-authentication-for-critical-function-vulnerability-in)
- [Fortinet FortiOS stack buffer overflow in WAD proxy](https://junglewise.ai/threats/cve-2026-126258-a-stack-based-buffer-overflow-vulnerability-in-fortinet-fortios)
- [Fortinet FortiOS out-of-bounds read in kernel](https://junglewise.ai/threats/cve-2026-126256-a-out-of-bounds-read-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS path traversal authentication bypass in SSH daemon](https://junglewise.ai/threats/cve-2026-126255-a-path-traversal-filedir-vulnerability-in-fortinet-fortios-8-0-0)
- [Fortinet FortiOS numeric truncation error in BGP daemon](https://junglewise.ai/threats/cve-2026-126254-a-numeric-truncation-error-vulnerability-in-fortinet-fortios-8-0)