FortiOS SSLVPN certificate validation flaw: check affected versions and upgrade

CVE-2026-121528 FortiOS

Fortinet disclosed CVE-2026-121528, an improper certificate validation flaw in FortiOS SSLVPN that may let an unauthenticated remote attacker perform a Man-in-the-Middle attack. Check affected branches and upgrade to a fixed release.

FortiOS SSLVPN certificate validation flaw: check affected versions and upgrade

At a glance
FortiOS SSLVPN has an improper certificate validation flaw, CVE-2026-121528.
An unauthenticated remote attacker may perform a Man-in-the-Middle attack between the SSLVPN web portal and the backend destination website.
Affected branches include FortiOS 7.6, 7.4, 7.2, 7.0, and 6.4; FortiOS 8.0 is not affected.
Check the version and upgrade or move to a fixed release for the affected branch.

In this article

Fortinet PSIRT published an advisory about an improper certificate validation flaw in FortiOS SSLVPN. Administrators can consult Fortinet’s official notice to confirm the scope and upgrade guidance.

Overview and technical details

FortiOS SSLVPN provides an SSL VPN portal and a connection between the SSLVPN web portal and a backend destination website. Improper certificate validation may allow an unauthenticated remote attacker to perform a Man-in-the-Middle attack on this communication channel.

Field	Details
Product	FortiOS SSLVPN
CVE	CVE-2026-121528
CWE	CWE-295
CVSS	CVSSv3 7.7
Known Exploited	No
Source	Fortinet PSIRT

Affected systems

Product	Affected versions	Fixed versions
FortiOS	7.6.0–7.6.4	7.6.5 and later
FortiOS	7.4.0–7.4.9	7.4.10 and later
FortiOS	7.2.0–7.2.13	7.2.14 and later
FortiOS	All 7.0 versions	Move to a fixed release
FortiOS	All 6.4 versions	Move to a fixed release

FortiOS 8.0 is not affected.

Exploitation status

Fortinet lists Known Exploited as No. This is the exploitation status stated in the advisory; it should not be taken as a separate confirmation about a public PoC or zero-day status.

System checks

Check the FortiOS version currently running and compare it with the affected ranges.
```
get system status
```
A version in an affected range needs to be upgraded or moved to a fixed release.
Check the SSLVPN configuration for destination website certificate validation.
```
show full-configuration vpn ssl setting
```
On fixed 7.6 releases, the default is warn-on-error. The reject-on-error option rejects the connection when certificate validation fails. On fixed 7.4 and 7.2 releases, certificate checking is always enabled and cannot be changed.

Remediation and mitigation

Upgrade FortiOS 7.6 to 7.6.5 or later, 7.4 to 7.4.10 or later, or 7.2 to 7.2.14 or later. For FortiOS 7.0 and 6.4, move to a fixed release.
Use the upgrade path tool recommended by Fortinet to determine the upgrade path.
On fixed 7.6 releases, the certificate-check option can be configured. The default is warn-on-error; with reject-on-error, a certificate validation error displays a connection rejection page, and users can only close the connection.
```
config vpn ssl setting
set remote-https-cert-check <no-check/warn-on-error/reject-on-error/>
end
```
On fixed 7.4 and 7.2 releases, certificate checking is always enabled. If an error occurs, a warning page lets users accept the risk or close the connection.

References: Fortinet PSIRT