Fortinet has released patches for two (2) high-severity vulnerabilities impacting the FortiOS, FortiProxy, and FortiWeb products that could be exploited by threat actors to conduct cross-site scripting (XSS) attacks. The first flaw, tracked as CVE-2023-29183, is an improper neutralization of input flaw that occurs during web page generation. If successfully exploited, an authenticated attacker could trigger the execution of arbitrary JavaScript code via maliciously crafted guest management settings. The second vulnerability, tracked as CVE-2023-34984, is a protection mechanism failure in Fortinet’s FortiWeb product. This flaw could be exploited by sending maliciously crafted HTTP requests, bypassing existing XSS and cross-site request forgery (CSRF) protections to execute unauthorized code or commands. Although at this time there is no evidence that these vulnerabilities are under active exploitation, Fortinet bugs are a very popular target for threat actors to compromise organizations. CTIX analysts recommend all network administrators responsible for Fortinet devices ensure that their infrastructure is running the most secure versions of these products to prevent exploitation.