Update Fortinet 6.2 to 6.4+ to Stop XSS Attacks via Identity Provider Name Field

Fortinet has issued an advisory regarding a security weakness in the web management interfaces of FortiManager and FortiAnalyzer. The company states that an HTML injection flaw in these products may allow an attacker to execute a cross-site scripting (XSS) attack. This vulnerability specifically targets the Identity Provider name field within the web user interface, creating a pathway for malicious script execution.

The issue is rated with a CVSSv3 score of 4.9, which Fortinet classifies as a medium severity risk. The vulnerability exists because the web page does not properly neutralize script-related HTML tags. This improper handling allows an attacker to inject harmful code into the page viewed by other users or administrators interacting with the interface. The advisory was revised on October 13, 2026, to update the status of this finding.

Scope of Affected Versions

The vulnerability impacts specific versions of two Fortinet management products. FortiManager is affected in versions 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, and 6.2.6. Similarly, FortiAnalyzer is vulnerable in the same version range: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, and 6.2.6. Administrators using any of these specific builds should verify their current software version immediately to determine if they are exposed to this risk.

What to watch

Fortinet advises users of the affected versions to upgrade their systems to mitigate the risk. Specifically, administrators should upgrade FortiManager to version 6.4.0 or any subsequent higher version. The same remediation applies to FortiAnalyzer, which should also be upgraded to version 6.4.0 or above. These updates contain the necessary fixes to neutralize the HTML tags properly and prevent the cross-site scripting attack vector described in the advisory.

What made it possible

This vulnerability stems from a failure to sanitize user input within a web application. When a system accepts data from a user, such as a name field, it must ensure that any embedded code is treated as text rather than executable instructions. In this case, the application failed to strip or encode HTML tags from the Identity Provider name. This allows an attacker to inject scripts that run in the browser of anyone viewing the page. Understanding this input validation gap helps teams prioritize reviewing form fields in their own web interfaces.

Background: Cross-site scripting (XSS)

To mitigate cross-site scripting, you must encode data before rendering it in the browser. Input validation is insufficient because it rarely covers all edge cases. Implement Content Security Policy headers to restrict script sources. Use framework auto-encoding features to prevent accidental injection of malicious code into your HTML responses.

Read the full guide: How to Mitigate Cross Site Scripting: A Risk-Based Approach

What to do and how to stay safe: Fortinet

• Verify the current version of FortiManager and FortiAnalyzer installed in your environment against the list of affected builds.
• Plan and execute an upgrade to version 6.4.0 or higher for both products as soon as operationally feasible.
• Monitor web interface logs for any unusual activity or unexpected script execution related to the Identity Provider configuration.
• Review your organization's input validation policies for web forms to ensure similar injection risks are addressed in other applications.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific versions of FortiManager are vulnerable to this HTML injection?

FortiManager versions 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, and 6.2.6 are affected by this vulnerability.

What is the CVSS score assigned to this cross-site scripting flaw?

The vulnerability has a CVSSv3 score of 4.9, indicating a medium severity risk according to the advisory.

How can administrators fix this security issue on their systems?

Administrators should upgrade FortiManager and FortiAnalyzer to version 6.4.0 or any later available version to resolve the flaw.