CVE-2026-84390

Executive Summary

CVE-2026-84390 is a critical (CVSS 9.8) improper access control vulnerability in Fortinet FortiMonitorOnSight, stemming from the inclusion of sensitive information in source code (CWE-540). The flaw affects FortiMonitorOnSight versions 7.2.0 through 7.2.2 and 7.2.4 through 7.2.7, exposing deployed monitoring infrastructure to unauthenticated remote attackers who can leverage embedded secrets to bypass access controls. With no vendor patch, no public PoC, and no CISA KEV listing, the vulnerability remains an unmitigated risk for organizations running the affected monitoring platform.

Technical Analysis

CVE-2026-84390 is classified under CWE-540: Inclusion of Sensitive Information in Source Code. This weakness class describes scenarios in which credentials, API keys, cryptographic material, or other secrets are embedded directly into application source code (or into client-delivered artifacts such as JavaScript bundles, configuration files served to browsers, or compiled binaries) rather than being stored in protected configuration stores or secret management systems.

The NVD description states that this flaw "may allow attacker to improper access control." The wording indicates that the impact of the exposed secret material is an access-control bypass — meaning the embedded sensitive information is plausibly tied to authentication or authorization logic. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N (network-reachable, low complexity, no privileges, no user interaction), the exploitation path is presumed to be reachable directly over the network without authentication.

Two crucial caveats apply to the public data:

1. The attack vector placeholder is unresolved. The NVD description literally contains the templated string <insert attack vector here>, indicating the advisory was published with incomplete technical detail. This is common in early-lifecycle or low-quality CVE records.
2. No specific function names, endpoints, file paths, or parameters are disclosed. Per accuracy constraints, this report describes the vulnerability class and mechanism rather than fabricating implementation specifics that do not appear in the source data.

Mechanism at the class level

When sensitive information (e.g., hardcoded credentials, tokens, or keys) is embedded in source code or in statically served artifacts:

• The secret is uniformly present across all deployments of the affected version — there is no per-installation entropy, so one leaked value compromises every instance.
• The secret may be recoverable by an unauthenticated party if it is delivered to clients (e.g., in a web bundle) or shipped in a component an attacker can obtain.
• Once recovered, the secret can be replayed against the application or an adjacent service to bypass expected access controls, resulting in the high confidentiality/integrity/availability impact reflected in the CVSS subscores (C:H/I:H/A:H).

Attack surface

FortiMonitorOnSight is a monitoring/management platform. Such platforms are typically deployed on internal management networks but frequently exposed via web consoles and API endpoints. The AV:N vector and the monitoring product context imply the exploitable surface is the network-facing web/API layer of the application. No authentication is required (PR:N), and no victim interaction is needed (UI:N).

Insufficient technical detail is available to identify the specific code location, secret type, or endpoint involved. Analyses requiring that granularity should await a vendor advisory or coordinated disclosure.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-84390, and no Nuclei template is available. The following attack chain is inferred strictly from the vulnerability class (CWE-540) and the NVD description; it describes mechanisms at the class level and does not assert implementation details not present in the source data.

1. Reconnaissance / target identification. An attacker enumerates internet- and intranet-exposed FortiMonitorOnSight instances using product-fingerprint queries (see Shodan dorks above). Version identification narrows targets to the affected ranges (7.2.0-7.2.2 and 7.2.4-7.2.7), since the flaw is version-scoped.

2. Triggering the specific flaw class. Because sensitive information is embedded in source code / client-delivered artifacts, the attacker retrieves the artifact that contains the secret. For a web-delivered application, this typically means inspecting client-side bundles or publicly retrievable resources; for a shipped component, it means obtaining the artifact. The attacker then extracts the embedded secret. No authentication is required to reach this stage.

3. Payload / execution method (class level). The recovered secret is used to defeat an access-control check — for example, by presenting it as a valid credential/token or by using it to authenticate to a privileged interface. Per the NVD text, the outcome is "improper access control," i.e., the attacker gains access or privileges they should not hold.

4. Post-exploitation impact. Successful access-control bypass against a monitoring/management platform yields high confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with an attacker reading monitoring data/credentials, altering configuration, or disrupting the monitored environment. Since the secret is embedded (static), remediation requires code change, not credential rotation alone.

Note: Because no technical detail identifies the precise secret, endpoint, or control, defenders should treat this as a class-level exposure and hunt for anomalous access to FortiMonitorOnSight interfaces rather than rely on a single indicator.

Impact Assessment

• Severity: Critical — CVSS 3.1 base score 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
• Confidentiality (High): Embedded secrets and, via the resulting access-control bypass, potentially sensitive monitoring data, credentials, or configuration are exposed.
• Integrity (High): The access-control bypass permits unauthorized modification of platform state, configuration, or monitored data.
• Availability (High): A monitoring/management platform is a high-value target; unauthorized access could enable disruption of the platform or the infrastructure it supervises.
• Exploitability: Low complexity, no privileges, no user interaction, network-reachable — highly favorable to an attacker.
• Blast radius: Every deployment of the affected versions shares the same embedded-secret weakness; a single recovered value may be reusable across all exposed instances in the affected ranges.
• Business impact: FortiMonitorOnSight class functionality sits in management/monitoring tiers — compromise can provide a pivot into broader infrastructure, exfiltration of operational telemetry, and tampering with detection/alerting. The Scope: Unchanged (S:U) rating limits the formal CVSS scope, but logically an access-control bypass in a monitoring platform can affect downstream systems.
• EPSS: Not yet scored by FIRST.org at the time of this report — do not rely on an EPSS value.
• KEV: Not listed in CISA KEV.

Detection Guidance

The detectors below target behavior consistent with an access-control bypass / secret-based access abuse against FortiMonitorOnSight. Because no specific endpoint or parameter is disclosed, rules use product/version context and generic suspicious-access patterns. Tune to your environment.

Sigma Rule

title: Potential FortiMonitorOnSight Access Control Bypass (CVE-2026-84390)
id: 3f9a1c2e-7b41-4d8a-9e52-0c6d1a2b8f10
status: experimental
description: Detects requests to FortiMonitorOnSight web/API interfaces exhibiting access-control bypass patterns associated with CVE-2026-84390 (CWE-540, hardcoded sensitive information).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84390
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-84390
logsource:
  category: webserver
detection:
  selection_product:
    cs-uri-stem|contains:
      - '/FortiMonitor'
      - '/fortimonitor'
      - '/OnSight'
      - '/onsight'
  selection_suspicious:
    - cs-uri-query|contains:
        - 'token='
        - 'apikey='
        - 'api_key='
        - 'key='
        - 'secret='
        - 'auth='
    - sc-status:
        - 200
        - 302
  condition: selection_product and selection_suspicious
falsepositives:
  - Legitimate authenticated API use
  - Monitoring health checks
level: high

YARA Rule

rule CVE_2026_84390_FortiMonitorOnSight_Hardcoded_Secret
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects hardcoded credential/secret indicators in FortiMonitorOnSight artifacts (CWE-540 / CVE-2026-84390)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84390"
        date = "2026-01-01"
        severity = "high"

    strings:
        $prod1 = "FortiMonitorOnSight" ascii wide nocase
        $prod2 = "FortiMonitor" ascii wide nocase
        $prod3 = "OnSight" ascii wide nocase

        $kw1 = "api_key" ascii wide nocase
        $kw2 = "apikey" ascii wide nocase
        $kw3 = "secret" ascii wide nocase
        $kw4 = "password" ascii wide nocase
        $kw5 = "token" ascii wide nocase
        $kw6 = "Bearer " ascii wide
        $kw7 = "AKIA" ascii           // AWS-style key prefix
        $kw8 = "-----BEGIN" ascii      // PEM private key material

    condition:
        (any of ($prod*)) and (any of ($kw*)) and filesize < 20MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84390 FortiMonitorOnSight Potential Access Control Bypass via Embedded Secret"; flow:established,to_server; http.uri; content:"FortiMonitor"; nocase; http.uri; content:"token="; nocase; http.header; content:"Authorization"; nocase; reference:cve,2026-84390; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84390; classtype:attempted-admin; sid:2026843901; rev:1;)

Variant using product-agnostic secret-bearing request patterns:

alert http any any -> any any (msg:"CVE-2026-84390 FortiMonitorOnSight OnSight API Access with Embedded Key"; flow:established,to_server; http.uri; content:"OnSight"; nocase; http.uri; pcre:"/(api_?key|secret|token)=[A-Za-z0-9._-]{8,}/i"; reference:cve,2026-84390; classtype:attempted-admin; sid:2026843902; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where
      network.protocol == "http" and
      (
        url.path : "*FortiMonitor*" or
        url.path : "*OnSight*" or
        url.path : "*fortimonitor*" or
        url.path : "*onsight*"
      ) and
      http.response.status_code in (200, 302)
  ] with runs=1

Simpler threshold-style EQL for high-volume access-control probing:

network where
  url.path : "*OnSight*" and
  (url.query : "*token=*" or url.query : "*apikey=*" or url.query : "*api_key=*" or url.query : "*secret=*") and
  http.response.status_code == 200

Splunk SPL Query

index=web OR index=proxy (uri_path="*FortiMonitor*" OR uri_path="*OnSight*" OR uri_path="*fortimonitor*" OR uri_path="*onsight*")
| eval suspicious = if(match(uri_query, "(?i)(token|apikey|api_key|secret|key)="), 1, 0)
| where suspicious=1 AND status IN (200, 302)
| stats count min(_time) AS first_seen max(_time) AS last_seen values(uri_path) AS paths values(status) AS codes by src_ip
| where count > 5
| sort - count
| table src_ip, count, first_seen, last_seen, paths, codes

Wazuh OSSEC Rule

<group name="web,fortinet,cve-2026-84390,">
  <rule id="202684390" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>FortiMonitor|OnSight|fortimonitor|onsight</url>
    <regex type="pcre2">(?i)(token|apikey|api_key|secret|key)=</regex>
    <description>CVE-2026-84390: FortiMonitorOnSight access with embedded secret indicator - potential access control bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. There is no vendor fix, no workaround, and no listed OSV package affected. The following controls are compensating, not verified remediations.

1) Immediate mitigations (compensating controls)

• Restrict network exposure. Do not expose FortiMonitorOnSight web/API interfaces to the internet. Enforce access via VPN, jump hosts, or a management VLAN, and validate with a Shodan/external scan that no affected instance is internet-reachable.
• Apply strict access control at the network layer. Segment the platform; restrict inbound access to known administrative source IPs using firewall/DMZ policy.
• Assume embedded secrets are compromised. Because CWE-540 values are static and shipped with the product, treat any secrets plausibly embedded in the affected versions as exposed and plan for their rotation at the application/adjacent-service level where possible.
• Increase monitoring. Hunt for anomalous authenticated activity against FortiMonitorOnSight (see Detection Guidance) and for unexpected use of API keys/tokens.
• Isolate where feasible. If the platform is not essential, take affected instances offline until a fix is available.

2) Patch / upgrade steps

• No patch is currently available. No fixed version has been published by the vendor; patch confidence is 0/4.
• Monitor vendor channels. Watch the Fortinet PSIRT advisories and NVD entry for an updated description (including resolution of the placeholder <insert attack vector here> text) and a fixed-version listing.
• Do not assume version downgrade is a fix. Both the 7.2.0-7.2.2 and 7.2.4-7.2.7 ranges are listed as affected; there is no indicated safe version in the provided data.
• Validate before deploying any future fix. Once a patch appears, verify it addresses the specific CWE-540 exposure (removal of hardcoded sensitive information) rather than only a symptom.

3) Long-term hardening

• Secret management. Ensure monitoring/management platforms retrieve secrets from a dedicated secrets manager (e.g., Vault, KMS-backed stores) rather than from source or client-delivered artifacts.
• Secure SDLC. Add static analysis (SAST) and secret-scanning gates to CI/CD to detect CWE-540-class issues (hardcoded credentials/keys) before release.
• Client artifact review. Periodically scan client-delivered bundles and shipped components for embedded secrets.
• Least privilege. Scope any issued tokens/keys to the minimum required privilege to reduce the impact of future exposure.
• Defense in depth. Combine network segmentation, strong authentication, and continuous detection so that a single class-level secret weakness does not translate directly into full platform compromise.

References

1. NVD — CVE-2026-84390: https://nvd.nist.gov/vuln/detail/CVE-2026-84390
2. CWE-540: Inclusion of Sensitive Information in Source Code — https://cwe.mitre.org/data/definitions/540.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
4. Fortinet PSIRT Advisories (monitor for a FortiMonitorOnSight advisory referencing this CVE) — https://www.fortiguard.com/psirt
5. CISA Known Exploited Vulnerabilities Catalog (verify current status; as of this report, CVE-2026-84390 is not listed) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild / threat actor evidence: None available. No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing. EPSS has not been scored. This report should be re-evaluated as vendor and community data mature.