CVE-2026-84386

MediumCVSS 5.1/10Last modified Oct 2, 2026

Description

A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via via an exposed minifilter communication port.

Metrics

CVSS 3.1 5.1/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-283

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 8, 2026
Last modified
Oct 2, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-843877.2A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSanCVE-2026-843889.6A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM ChromeCVE-2026-843893.1A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2CVE-2026-843909.8A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7CVE-2026-843916.5A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insCVE-2026-843922.7A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.CVE-2026-843938.1A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.CVE-2026-843947.5fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opCVE-2026-843957.1Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resultiCVE-2026-843965.5InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker CVE-2026-843975.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-843987.5CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network a