CVE-2026-84390

FortiMonitorOnSight Source Code Sensitive Information Disclosure

Published Sep 11, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Description

A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via <insert attack vector here>

Analysis

Technical impact

The vulnerability arises from the inclusion of sensitive information in the source code of FortiMonitorOnSight. This exposure can lead to unauthorized access or privilege escalation as an attacker might leverage leaked credentials or configuration data. The weakness aligns with CWE-540, indicating sensitive data stored in source code.

Affected Systems

Affected products are Fortinet FortiMonitorOnSight versions 7.2.0 through 7.2.7, encompassing releases 7.2.0–7.2.2 and 7.2.4–7.2.7. All these versions lack the fix which removes the sensitive information from the source.

Risk and Exploitability

The CVSS score is 9.6, signifying a high severity with potential for significant impact. An EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack vector is not explicitly provided; however, the description suggests that an attacker could gain improper access control by exploiting source code exposure. Given the severity, the risk to systems is considerable if the source code or configuration is exposed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Fortinet

FortiMonitorOnSight

unaffected

Version	Status	Constraints
`7.2.4`	affected	≤ 7.2.7
`7.2.0`	affected	≤ 7.2.2

No data.

Vendor Product Versions

Fortinet

Fortimonitoronsight

Version	Status	Scheme	Platform
`[7.2.4,7.2.7]`	affected	semver	—
`[7.2.0,7.2.2]`	affected	semver	—

Remediation

Vendor Solution

Upgrade to FortiMonitorOnSight version 7.2.8 or above

OpenCVE Recommended Actions

Upgrade FortiMonitorOnSight to version 7.2.8 or later
Conduct a code audit to locate and remove any sensitive data embedded in source code or configuration files
Implement strict repository access controls and employ secrets management to prevent future exposure of sensitive information
Adopt secure coding practices to avoid storing credentials or secrets in source code

Generated by OpenCVE AI on September 11, 2026 at 13:52 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.522% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://fortiguard.fortinet.com/psirt/FG-IR-26-170

History

Sep 11, 2026 2:15 PM Title updated View changes

Type	Values Removed	Values Added
Title		FortiMonitorOnSight Source Code Sensitive Information Disclosure

Sep 11, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 11, 2026 12:30 PM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via <insert attack vector here>
First Time appeared		Fortinet Fortinet fortimonitoronsight
Weaknesses		CWE-540
CPEs		cpe:2.3:a:fortinet:fortimonitoronsight:7.2.0:::::::* cpe:2.3:a:fortinet:fortimonitoronsight:7.2.1:::::::* cpe:2.3:a:fortinet:fortimonitoronsight:7.2.2:::::::* cpe:2.3:a:fortinet:fortimonitoronsight:7.2.4:::::::* cpe:2.3:a:fortinet:fortimonitoronsight:7.2.5:::::::* cpe:2.3:a:fortinet:fortimonitoronsight:7.2.6:::::::* cpe:2.3:a:fortinet:fortimonitoronsight:7.2.7:::::::*
Vendors & Products		Fortinet Fortinet fortimonitoronsight
References		https://fortiguard.fortinet.com/psirt/FG-IR-26-170
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C'}`