SecBoard
Zurück zur CVE-Übersicht

CVE-2026-84388

CRITICAL(9.6)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Risk Signal Score24/100 — NIEDRIG
  • CVSS 9.6 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.4%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.6

Technische Schwere

Beschreibung

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions may allow attacker to information disclosure via remote unauthenticated attack

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • FortiPAM Chrome Extension 8.0.1.123
  • FortiPAM 1.9.1
  • FortiPAM 1.8.4

Threat-Hunting-Queries

Detects attempts to proxy user browser traffic, which could indicate exploitation of CVE-2026-84388. This requires monitoring network traffic and browser extension activities for unusual proxy configurations or connections to malicious sites.

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName has_any ("chrome.exe", "msedge.exe")
| where RemotePort == 8080 or RemotePort == 3128 or RemotePort == 8888 // Common proxy ports
| where RemoteIP !in ("127.0.0.1", "::1") // Exclude localhost
| summarize count() by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, ActionType
| where count_ > 5 // Adjust threshold as needed for your environment
| project DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, ActionType, count_

Splunk SPL

sourcetype=pan:traffic OR sourcetype=bro:conn
| (dest_port=8080 OR dest_port=3128 OR dest_port=8888) AND NOT dest_ip IN ("127.0.0.1", "::1")
| stats count by host, src_ip, dest_ip, dest_port
| where count > 5

Sigma

title: FortiPAM Chrome Extension Proxy Activity
status: experimental
description: Detects unusual proxy connections originating from Chrome browser processes, potentially indicating exploitation of CVE-2026-84388.
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\chrome.exe'
    DestinationPort:
      - 8080
      - 3128
      - 8888
    DestinationIp|!startswith:
      - '127.'
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
  condition: selection
falsepositives:
  - Legitimate proxy usage by Chrome extensions or applications.
level: medium

Elastic ES|QL

from network where process.name : ("chrome.exe", "msedge.exe") and (destination.port == 8080 or destination.port == 3128 or destination.port == 8888) and not destination.ip in ("127.0.0.1", "::1") | stats count() by host.name, process.name, destination.ip, destination.port | where count > 5

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen