EUVD-2026-43703
GHSA-wxrh-6ch6-6hp4
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
AV:N for HTTP-based attack; AC:H for mandatory ASLR and stack-canary bypass; PR:H as privileged admin credentials are explicitly required per the description.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.
AnalysisAI
Stack-based buffer overflow in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSASE enables arbitrary code execution for a privileged authenticated attacker capable of bypassing ASLR and stack canary protections via crafted HTTP requests. The CVSS temporal metric E:P confirms proof-of-concept exploit code exists, and RL:O confirms an official patch has been released by Fortinet (advisory FG-IR-26-148). This vulnerability is not listed in CISA KEV at time of analysis, and the dual prerequisites of privileged access plus memory-protection bypass substantially constrain real-world exploitability despite the critical CIA impact triad.
Technical ContextAI
CWE-121 (Stack-based Buffer Overflow) occurs when user-controlled data written to a stack-allocated buffer exceeds its bounds, overwriting return addresses or function pointers. In this case the vulnerable HTTP request processing code in FortiOS, FortiPAM, FortiProxy, and FortiSASE (per CPE strings cpe:2.3:a:fortinet:fortios, fortipam, fortiproxy, fortisase) fails to enforce input length bounds before writing to a stack buffer. Modern Fortinet appliance firmware deploys both stack canaries and ASLR as defense-in-depth mitigations, which is why the description explicitly requires the attacker to bypass these protections - indicating that the overflow alone is insufficient without a secondary technique (e.g., information leak for ASLR defeat or timing-based canary bypass). The attack surface is the administrative HTTP interface exposed on management plane network segments.
RemediationAI
Apply the official vendor patch released by Fortinet as confirmed by CVSS temporal metric RL:O (Official Fix). Consult the Fortinet PSIRT advisory FG-IR-26-148 at https://fortiguard.fortinet.com/psirt/FG-IR-26-148 for specific upgraded target versions across FortiOS, FortiPAM, FortiProxy, and FortiSASE - exact patched version numbers were not enumerated in the available data and must be confirmed directly from the advisory. As an immediate compensating control, restrict access to the FortiOS and FortiProxy administrative HTTP interface to a dedicated out-of-band management VLAN accessible only to authorized network administrators; this does not eliminate the vulnerability but effectively removes it from the attack surface for the vast majority of potential attackers, since PR:H already requires privileged credentials and removing network-level reachability stacks an additional barrier. Note that interface restriction may impact legitimate administrative workflows if management is currently performed over in-band paths.
A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.
A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10,
Authenticated remote code execution in Fortinet FortiOS, FortiProxy, and FortiPAM enables low-privileged users to trigge
A stack-based buffer overflow in Fortinet FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiWeb, Fo
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, Forti
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, Forti
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attac
A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.
A security vulnerability in Fortinet FortiPAM 1.4.0 (CVSS 6.3) that allows attacker. Remediation should follow standard
Reflected or stored cross-site scripting in Fortinet FortiOS, FortiPAM, and FortiProxy web interfaces allows a remote un
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today