CVE-2024-26006

score

<0.1

cvss

7.5

epss

0.6%

published

2025-03-14

kev added

—

first seen

2026-10-21

FortiOS 7.4.3 and below, 7.2.7 and below, 7.0.13 and below, and FortiProxy 7.4.3 and below, 7.2.9 and below, 7.0.16 and below contain a cross-site scripting caused by improper input neutralization during web page generation in the SSL VPN UI, letting remote unauthenticated attackers execute malicious scripts via a malicious samba server, exploit requires attacker to control a malicious samba server.