CVE-2024-26006

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to the fixed version FortiProxy versions prior to the fixed version

Description The issue exists due to improper neutralization of input during web page generation, allowing a remote attacker to perform Cross-Site Scripting attacks. This can be achieved through social engineering, where the targeted user is tricked into bookmarking a malicious Samba server and then opening the bookmark.

Recommendations For FortiOS versions prior to the fixed version, update to the latest version to resolve the issue. For FortiProxy versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the web SSL VPN UI to minimize the risk of exploitation.