CVE-2012-0941: Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiGate UTM WAF appliances with FortiOS 4...

Security readout for executives and security teams

CVE-2012-0941 is a set of cross-site scripting issues in Fortinet FortiGate UTM WAF appliances running FortiOS 4.3.x before 4.3.6. A remote attacker could inject script or HTML through specific interface modules or parameters. Business risk depends on whether those interfaces are exposed and who can reach them. Exposure is most likely in legacy FortiGate UTM WAF deployments still running FortiOS 4.3.x before 4.3.6. Risk rises if administrative or web management functions are reachable from untrusted networks. The source bundle has incomplete affected-product metadata, so inventory confirmation is required. Treat this as a legacy exposure cleanup item unless an affected appliance is internet-facing or broadly reachable. It is not KEV-supported active exploitation, but XSS on security infrastructure can still create operational and administrative risk. Prioritize inventory and upgrade confirmation. Mitigation focus: Upgrade affected FortiOS 4.3.x systems to 4.3.6 or later per Fortinet guidance.; Review Fortinet PSIRT guidance for any additional vendor-specific remediation.; Restrict management and WAF administrative interfaces to trusted networks only..

Prepared

Jun 7, 2026, 20:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.