CVE-2021-26092: Fortinet FortiOS

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters.

Affected products

• Fortinet FortiOS: from 5.2.10, up to and including 5.2.15; from 5.4.0, up to and including 5.4.13; from 5.6.0, up to and including 5.6.14; from 6.0.0, up to and including 6.0.12; from 6.2.0, up to and including 6.2.7; from 6.4.0, up to and including 6.4.4
• Fortinet FortiProxy: from 1.2.0, up to and including 1.2.9; version 2.0.0 only; version 2.0.1 only

Published 2022-02-24. Last modified 2026-06-17.