CVE-2026-84393

HighCVSS 8.1/10Last modified Oct 15, 2026

Description

A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via <insert attack vector here>

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-297

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Fortinet	FortiOS	>= 7.6.1, <= 7.6.6
Fortinet	FortiProxy	>= 7.6.2, <= 7.6.6
Siemens	RUGGEDCOM APE1808	< *

References

Timeline

Published: Sep 8, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-843947.5fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an op CVE-2026-843957.1Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulti CVE-2026-843965.5InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker CVE-2026-843975.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-843987.5CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network a CVE-2026-843998.8The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does CVE-2026-844003.1CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An CVE-2026-844036.2The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low En CVE-2026-844088.7QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC whe CVE-2026-844097.5The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metada CVE-2026-84417.5The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX CVE-2026-844107.3In apport before 2.37.0, an improper privilege management vulnerability allows an unprivileged local attacker to gain root privileges on sys