CVE-2026-84390

CriticalCVSS 9.8/10Last modified Sep 11, 2026

Description

A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via <insert attack vector here>

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-540

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 11, 2026
Last modified: Sep 11, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-843916.5A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <ins CVE-2026-843922.7A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.CVE-2026-843938.1A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.CVE-2026-843947.5fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an op CVE-2026-843957.1Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulti CVE-2026-843965.5InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker CVE-2026-843975.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-843987.5CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network a CVE-2026-843998.8The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does CVE-2026-844003.1CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An CVE-2026-844036.2The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low En CVE-2026-844088.7QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC whe