Plan ahead High Patch available CVSS 7.7
FortiOS SSL VPN flaw lets attacker intercept portal traffic
Fortinet PSIRTFortinet
What happened. Fortinet says improper certificate validation in FortiOS SSLVPN may let a remote, unauthenticated attacker run a man-in-the-middle attack between the SSLVPN web portal and the backend website. CVSS score 7.7. Revised 12 November 2026.
Who is affected. Users of Fortinet FortiOS SSLVPN. Industrial sites using it for remote access are exposed, because vendors and engineers often reach plant systems through such gateways.
What to do. Check whether you run FortiOS with SSLVPN web portal enabled, and apply the fix from the Fortinet advisory.
When to act. Plan ahead: Remote-access gateways for plant support: check your FortiOS SSL-VPN exposure before the next window.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L3.5
Why: FortiOS SSLVPN is a remote-access and boundary firewall function, placing it in the industrial DMZ (L3.5) or at the internet-facing edge (L5).
- Are you exposed?
Check your firewall inventory for FortiOS devices with the SSLVPN web portal enabled, and compare their versions with the Fortinet advisory.
- If you cannot fix it yet
- Limit who can use the SSLVPN web portal and require multi-factor authentication.
- Disable the SSLVPN web portal if it is not needed.
- Keep the firewall's management interface off the plant network until patched.
- Watch for
- Unexpected certificate errors or changes in SSLVPN portal sessions to backend sites.
- SSLVPN logons from unfamiliar sources followed by access to plant systems.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Fortinet PSIRT (opens fortiguard.fortinet.com)
More on Fortinet