CVE-2023-50176 is a medium severity (CVSS 4.2) session fixation flaw in Fortinet FortiOS. A phishing link for SAML authentication can let an attacker hijack a user session. Upgrade to FortiOS 7.4.4 or later on the 7.4 branch, or 7.2.8 or later on 7.2. FortiOS 7.0 users must migrate to a fixed release.
What's affected
- FortiOS 7.4.0 through 7.4.3. Upgrade to 7.4.4 or above.
- FortiOS 7.2.0 through 7.2.7. Upgrade to 7.2.8 or above.
- FortiOS 7.0.0 through 7.0.13. Fortinet says to migrate to a fixed release.
- FortiOS 7.6 and 6.4 are listed as not affected.
- Fortinet lists the component as SSL-VPN, the attack type as unauthenticated, and the flaw as not known to be exploited. The NVD record agrees on the 4.2 medium score and shows kev as false.
- The record describes the outcome as unauthorized code or commands, while Fortinet's advisory phrases the summary as a hijacked user session. Both come from the same advisory entry, FG-IR-23-475.
How to check if you're exposed
Check the firmware version from the FortiOS command line.
get system status
The version line shows the running release. Compare it with the ranges above. Then check whether SAML single sign on is configured for SSL-VPN, because the flaw concerns the SAML authentication link. Fortinet also provides an upgrade path tool at docs.fortinet.com/upgrade-tool.
What to do now
- Record the FortiOS version on every firewall and VPN gateway.
- Upgrade to 7.4.4, 7.2.8 or a later fixed release, following Fortinet's upgrade path tool.
- For 7.0.x devices, plan a migration to a supported fixed branch.
- Warn users to be careful with SSO and VPN login links received by email or chat, and to use bookmarked portals.
- Review SSL-VPN logs for logins from unexpected locations that follow a SAML sign in.
Why it matters
The weakness is CWE-384, session fixation. In this class, an attacker gets a victim to authenticate using a session identifier the attacker already knows or controls. When the application does not issue a fresh identifier after login, the attacker can then use the same session. Phishing is the delivery method here, which is why user interaction is part of the scoring.
The medium score reflects that the attacker must trick a user first. It still matters on a VPN gateway, since a hijacked session can give access to internal resources. Firewall firmware is easy to leave behind, so version tracking is the key control.
Quick check
Is FortiOS 7.6 affected?
No. Fortinet lists 7.6 and 6.4 as not affected.
Is CVE-2023-50176 exploited in the wild?
Fortinet lists Known Exploited as No, and the record shows kev as false.
Sources
- NVD record for CVE-2023-50176
- Fortinet PSIRT advisory FG-IR-23-475
Last reviewed: 19 October 2026.
