ZTNA Portal Improper Certificate Validation

Plan PatchCVSS 7.3FG-IR-26-174Sep 8, 2026

Fortinet

IT in OT - Fortinet products are commonly deployed at IT/OT network boundaries

Attack path

Attack VectorNetwork

Auth RequiredNone

ComplexityHigh

User InteractionNone needed

Summary

Fortinet's ZTNA (Zero Trust Network Access) Portal in FortiOS and FortiProxy contains an improper certificate validation flaw. The portal fails to properly verify SSL/TLS certificates presented by clients or intermediaries, allowing an attacker positioned on the network path to intercept connections or forge certificates and bypass authentication controls. Affected versions are FortiOS 7.6.1–7.6.6 and FortiProxy 7.6.2–7.6.6. FortiOS has a vendor fix in version 7.6.7 and later; FortiProxy has no patch available.

What this means

What could happen

An attacker with network access could intercept or forge authentication certificates to the ZTNA Portal, potentially gaining unauthorized access to protected applications and network resources. This could allow attackers to bypass access controls and reach critical infrastructure or sensitive operational systems.

Who's at risk

Organizations using Fortinet FortiOS (versions 7.6.1–7.6.6) or FortiProxy (versions 7.6.2–7.6.6) as ZTNA (Zero Trust Network Access) gateways should care. This affects utilities, water authorities, and industrial facilities that rely on FortiOS/FortiProxy as their primary remote access control mechanism for OT engineers, field technicians, or distributed monitoring systems. Any organization where ZTNA is the only barrier between external networks and critical operational technology systems is at risk.

How it could be exploited

An attacker on the network path between a user and the ZTNA Portal could perform a man-in-the-middle attack by presenting a forged or invalid certificate that the portal fails to properly validate. The portal would accept the malicious certificate and establish a connection, allowing the attacker to intercept traffic or impersonate the legitimate portal to capture credentials or session tokens.

Prerequisites

Network position on the traffic path between clients and the ZTNA Portal (e.g., compromised network segment, rogue WiFi, or ISP-level access)
Ability to present a certificate during the TLS handshake (does not require valid certificate authority trust, as the portal does not properly validate it)

remotely exploitablenetwork-adjacent attacker requiredhigh impact if exploited (bypasses authentication controls)FortiProxy has no patch available

Exploitability

Unlikely to be exploited — EPSS score 0.3%

Affected products (2)

1 with fix1 EOL

ProductAffected VersionsFix Status

FortiOS7.6.1 - 7.6.67.6.7+

FortiProxy7.6.2 - 7.6.6No fix (EOL)

Remediation & Mitigation

0/5

Do now

0/2

FortiProxy

HARDENINGFor FortiProxy: isolate the ZTNA Portal on a protected network segment and implement strict firewall rules to restrict access to only authorized clients and networks

All products

WORKAROUNDMonitor ZTNA Portal logs for suspicious connection attempts or certificate validation errors

Schedule — requires maintenance window

0/1

Patching may require device reboot — plan for process interruption

FortiOS

HOTFIXUpdate FortiOS to version 7.6.7 or later

Mitigations - no patch available

0/2

FortiProxy has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:

HARDENINGImplement network segmentation to restrict client access to the ZTNA Portal to trusted networks only

HARDENINGEnable certificate pinning or additional certificate validation mechanisms on client-side applications connecting to the ZTNA Portal if available

CVEs (1)

CVE-2026-84393

View full vendor advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/77d7c694-c85a-4018-a68b-982f8958e01d

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.