CVE-2022-38376: Fortinet Fortinac

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests.

Affected products

• Fortinet Fortinac: from 8.5.0, up to and including 8.5.4; from 8.6.0, before 9.4.2 (fixed in 9.4.2); version 8.3.7 only

Published 2023-02-16. Last modified 2026-06-17.