---
id: CVE-2026-23573
title: >-
  An Improper Neutralization of Input During Web Page Generation ('Cross-site
  Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0
  through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM
  1.8.0, For…
summary: >-
  An Improper Neutralization of Input During Web Page Generation ('Cross-site
  Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0
  through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM
  1.8.0, For…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-79
vendor: Fortinet
product: FortiOS
affected:
  - FortiOS >= 7.6.0 <= 7.6.6
  - FortiOS >= 7.4.0 <= 7.4.12
  - FortiOS >= 7.2.0 <= 7.2.13
  - FortiOS >= 7.0.0 <= 7.0.19
  - FortiOS >= 6.4.0 <= 6.4.16
  - FortiProxy >= 7.4.0 <= 7.4.3
  - FortiProxy >= 7.2.0 <= 7.2.9
  - FortiProxy >= 7.0.0 <= 7.0.16
  - FortiPAM 1.8.0
  - FortiPAM >= 1.7.0 <= 1.7.2
  - FortiPAM >= 1.6.0 <= 1.6.2
  - FortiPAM >= 1.5.0 <= 1.5.1
  - FortiPAM >= 1.4.0 <= 1.4.3
  - FortiPAM >= 1.3.0 <= 1.3.1
  - FortiPAM 1.2.0
  - FortiPAM >= 1.1.0 <= 1.1.2
  - FortiPAM >= 1.0.0 <= 1.0.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-14T15:57:48.078417Z'
published: '2026-07-14'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:15:28.767Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23573'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-150'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-150'
tags:
  - cve.org
epss: 0.00385
epssPercentile: 0.30816
ingestedAt: '2026-10-15T05:52:46.034Z'
---

## Overview

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9 may allow an authenticated remote user to execute code or commands via crafted requests.

## Affected

- `FortiOS >= 7.6.0 <= 7.6.6`
- `FortiOS >= 7.4.0 <= 7.4.12`
- `FortiOS >= 7.2.0 <= 7.2.13`
- `FortiOS >= 7.0.0 <= 7.0.19`
- `FortiOS >= 6.4.0 <= 6.4.16`
- `FortiProxy >= 7.4.0 <= 7.4.3`
- `FortiProxy >= 7.2.0 <= 7.2.9`
- `FortiProxy >= 7.0.0 <= 7.0.16`
- `FortiPAM 1.8.0`
- `FortiPAM >= 1.7.0 <= 1.7.2`
- `FortiPAM >= 1.6.0 <= 1.6.2`
- `FortiPAM >= 1.5.0 <= 1.5.1`
- `FortiPAM >= 1.4.0 <= 1.4.3`
- `FortiPAM >= 1.3.0 <= 1.3.1`
- `FortiPAM 1.2.0`
- `FortiPAM >= 1.1.0 <= 1.1.2`
- `FortiPAM >= 1.0.0 <= 1.0.3`

## Remediation

Upgrade to FortiOS version 8.0.0 or above
Upgrade to FortiOS version 7.6.7 or above
Upgrade to FortiProxy version 7.4.4 or above
Upgrade to FortiProxy version 7.2.10 or above
Upgrade to FortiProxy version 7.0.17 or above
Upgrade to FortiPAM version 1.9.0 or above
Upgrade to FortiPAM version 1.8.1 or above
Fortinet remediated this issue in FortiSASE version 26.1.1 and hence customers do not need to perform any action.
Upgrade to FortiSwitchManager version 7.2.5 or above
Upgrade to FortiSwitchManager version 7.0.3 or above