Improper Authentication of FortiPAM Server

The full story

Improper Authentication of FortiPAM Server. 1 An improper authentication vulnerability [CWE-287] in the Fortinet Privileged Access Agent Chrome Extension may allow a remote unauthenticated attacker to proxy a user's browser traffic through attacker controlled servers if the user visits a malicious website. An authentication weakness can let an attacker cross a security boundary without passing the identity checks that normally protect the affected function or service.

The vulnerability puts affected the affected technology systems at risk when the vulnerable service or function is reachable from attacker-controlled network traffic. An authentication weakness can let an attacker reach a protected function without passing the identity checks that normally stand in the way. Exposure — Required condition: an affected Chrome instance is reachable from a network position available to the attacker.

A security weakness in the affected technology is being tracked as a newly reported vulnerability. The flaw is described as a authentication weakness vulnerability. The available description indicates that the vulnerable path can be reached remotely or from an untrusted network, so the exposure of the affected technology becomes part of the attack condition.

Revised on 2026-09-08 00:00:00. The flaw is classified as an authentication weakness. the development is primarily about a software weakness.

Risk depends on whether the affected product and versions are present, whether the vulnerable function is reachable, whether exploitation is public or active, and what privileges the affected process carries. Confirmed Security outcome — successful exploitation can bypass the authentication boundary described in the reporting and reach functionality that should require trusted access. The story is primarily about a software weakness.

Confirmed Initial trigger — attacker-controlled network input reaches the vulnerable function on the affected Chrome service. The service does not have to look broken first: exploitation begins when malicious input reaches the vulnerable code path described in the advisory. Confirmed Exploit mechanism — the reported authentication bypass is triggered inside Chrome, crossing the security boundary described by the advisory or vulnerability record.

Defender interruption point — Identify remotely reachable Chrome; remove unnecessary exposure; apply the vendor fix or mitigation; then review service, network and identity telemetry for exploitation attempts or unexpected follow-on activity. Inventory affected products and versions. Validate external and internal reachability of the vulnerable function.

Apply the vendor fix or mitigation and review telemetry for exploitation indicators when available. Fortinet PSIRT published or catalogued the primary evidence used for this article on Sep 8, 2026.