Improper Certificate Validation in FortiOS SSLVPN Enables Remote MITM Attacks
Fortinet disclosed an improper certificate validation vulnerability (CWE-295) in FortiOS SSLVPN that may allow a remote, unauthenticated attacker to conduct a Man-in-the-Middle (MITM) attack on the channel between the SSLVPN web portal and backend website. Fixed FortiOS 7.6 versions offer a configurable option to control remote HTTPS certificate checks, defaulting to warn-on-error, with an option to reject connections on error. Versions 7.4 and 7.2 enforce certificate checks without the ability to disable them, presenting warnings to users on errors. The vendor does not explicitly state the severity or confirm exploitation in the wild, so the operational risk depends on configuration and usage context.
Entenda a falha
A vulnerabilidade
An improper certificate validation flaw (CWE-295) in the FortiOS SSLVPN lets a remote, unauthenticated attacker perform a Man-in-the-Middle attack on the channel between the SSLVPN web portal and the backend destination website. No CVE is listed for it (advisory FG-IR-26-193). Fixed releases are in the 7.6, 7.4 and 7.2 branches; the articles do not give exact build numbers or the list of vulnerable versions. The vendor does not state a severity.
Como funciona
When a user reaches a backend website through the SSLVPN web portal, the FortiOS portal opens an HTTPS connection to that destination on the user's behalf. In vulnerable versions the portal does not properly validate the destination's certificate. An attacker positioned on that path can therefore present a certificate that should be rejected and have it accepted, placing themselves between the portal and the website.
Por que é vulnerável
The root cause is improper certificate validation: the portal does not reliably check the certificate of the remote HTTPS site it connects to. The fix changes this by enforcing the check. In 7.4 and 7.2 the check is always on and cannot be disabled, and on an error the user sees a warning page and can accept the risk or close the connection. In 7.6 a new option, remote-https-cert-check, offers no-check, warn-on-error (default) and reject-on-error.
Onde está
The advisory names the SSLVPN web portal component and the 7.6 setting remote-https-cert-check under config vpn ssl setting; no source file or function is public.
Como foi descoberta
The articles do not say who found the flaw or how. Fortinet published it in its PSIRT advisory FG-IR-26-193 on 2026-11-10, and does not confirm exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 18:16.
Linha do tempo
-
Improper Certificate Validation in FortiOS SSLVPN Enables Remote MITM Attacks
ler a análise desta fonte ocultar
Fortinet disclosed an improper certificate validation vulnerability (CWE-295) in FortiOS SSLVPN that may allow a remote, unauthenticated attacker to conduct a Man-in-the-Middle (MITM) attack on the channel between the SSLVPN web portal and backend website. Fixed FortiOS 7.6 versions offer a configurable option to control remote HTTPS certificate checks, defaulting to warn-on-error, with an option to reject connections on error. Versions 7.4 and 7.2 enforce certificate checks without the ability to disable them, presenting warnings to users on errors. The vendor does not explicitly state the severity or confirm exploitation in the wild, so the operational risk depends on configuration and usage context.