Sep 10, 2026 · 7 min
Fortinet patches critical authentication flaws
Fortinet auth holes, China distills AI, Mythos vulnerability
The vulnerabilities could let attackers bypass authentication or abuse a privileged browser extension, making the patch details relevant to Fortinet customers and defenders.
- 1Fortinet patched 10 vulnerabilities, including two critical unauthenticated flaws affecting FortiMonitor and FortiPAM.
- 2A JWT-based bypass could expose the FortiMonitor on-site web portal without valid credentials.
- 3A malicious website could turn the privileged FortiPAM Access Agent Chrome extension into a traffic proxy.
Don't miss
The most consequential detail is that visiting a malicious website could turn the privileged FortiPAM Access Agent Chrome extension into a traffic proxy.
The brief
The episode uses the CISO Series daily-headlines format to isolate one urgent development: Fortinet’s patch for 10 product vulnerabilities, including two critical authentication flaws.
Sarah Lane reports that one flaw could enable a JWT-based authentication bypass against the FortiMonitor on-site web portal, allowing access without normal authentication.
The second critical issue affects the privileged FortiPAM Access Agent Chrome extension: after a user visits a malicious website, the extension could be turned into a traffic proxy.
Together, the flaws show how authentication weaknesses and privileged browser tooling can create different attack paths across monitoring and access-management products.
The briefing closes with the broader CISO Series daily-news format and directs listeners to CISOseries.com for full story details.
Books & mentions
CISOseries.com
The episode directs listeners there for the full cybersecurity stories.