CVE-2023-50178 is a high severity (CVSS 7.4) improper certificate validation flaw in Fortinet FortiADC. A remote, unauthenticated attacker may be able to run a man in the middle attack on the channel between the device and servers such as private SDN connectors and FortiToken Cloud. Upgrade to 7.4.1 or later, or 7.2.4 or later.
What's affected
- FortiADC 7.4.0. Upgrade to 7.4.1 or above.
- FortiADC 7.2.0 through 7.2.3. Upgrade to 7.2.4 or above.
- FortiADC 7.1, 7.0, 6.2, 6.1 and 6.0, all versions. Fortinet says to migrate to a fixed release.
- FortiADC 5.4 is listed as not affected.
- Fortinet rates it High with a CVSS 7.4, found internally, not known to be exploited. The record agrees on the score and shows kev as false.
- The impact Fortinet lists is information disclosure.
How to check if you're exposed
Run the status command on each FortiADC unit.
get system status
Read the version from the output and compare it with the table above. Also list which integrations the device uses. The advisory names private SDN connectors and FortiToken Cloud as examples of connections that depend on certificate validation, so those are where interception matters most.
What to do now
- Inventory FortiADC appliances and their firmware versions.
- Upgrade 7.4.0 to 7.4.1 or later and 7.2.x to 7.2.4 or later.
- Migrate devices on 7.1 and earlier to a fixed release. Fortinet offers no patch within those branches.
- Until upgraded, keep outbound connections from the device on trusted network paths and restrict where it can reach.
- Review which remote services the device talks to and confirm they match what you expect.
Why it matters
The weakness is CWE-295, improper certificate validation. A client that does not properly check the certificate of the server it connects to cannot tell the real server from an impostor. An attacker positioned on the path can present their own certificate, read the traffic, and possibly change it.
Two things raise the stakes. FortiADC sits in front of applications, so the data it exchanges with remote services can include credentials and tokens. And the affected range is broad, since every version of several older branches is listed. For those, the advice is migration, not a point release.
Quick check
Do I need to be on the same network as the device to attack it?
The vector in the record is network, but the attacker must be able to intercept the connection between the device and the remote server, a man in the middle position.
Is there a patch for FortiADC 7.0?
Fortinet lists 7.0 as affected in all versions and says to migrate to a fixed release.
Sources
- NVD record for CVE-2023-50178
- Fortinet PSIRT advisory FG-IR-22-298
Last reviewed: 19 October 2026.
