EUVD-2026-43703
GHSA-wxrh-6ch6-6hp4
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
AV:N for HTTP-based attack; AC:H for mandatory ASLR and stack-canary bypass; PR:H as privileged admin credentials are explicitly required per the description.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.
AnalysisAI
Stack-based buffer overflow in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSASE enables arbitrary code execution for a privileged authenticated attacker capable of bypassing ASLR and stack canary protections via crafted HTTP requests. The CVSS temporal metric E:P confirms proof-of-concept exploit code exists, and RL:O confirms an official patch has been released by Fortinet (advisory FG-IR-26-148). This vulnerability is not listed in CISA KEV at time of analysis, and the dual prerequisites of privileged access plus memory-protection bypass substantially constrain real-world exploitability despite the critical CIA impact triad.
Technical ContextAI
CWE-121 (Stack-based Buffer Overflow) occurs when user-controlled data written to a stack-allocated buffer exceeds its bounds, overwriting return addresses or function pointers. In this case the vulnerable HTTP request processing code in FortiOS, FortiPAM, FortiProxy, and FortiSASE (per CPE strings cpe:2.3:a:fortinet:fortios, fortipam, fortiproxy, fortisase) fails to enforce input length bounds before writing to a stack buffer. Modern Fortinet appliance firmware deploys both stack canaries and ASLR as defense-in-depth mitigations, which is why the description explicitly requires the attacker to bypass these protections - indicating that the overflow alone is insufficient without a secondary technique (e.g., information leak for ASLR defeat or timing-based canary bypass). The attack surface is the administrative HTTP interface exposed on management plane network segments.
RemediationAI
Apply the official vendor patch released by Fortinet as confirmed by CVSS temporal metric RL:O (Official Fix). Consult the Fortinet PSIRT advisory FG-IR-26-148 at https://fortiguard.fortinet.com/psirt/FG-IR-26-148 for specific upgraded target versions across FortiOS, FortiPAM, FortiProxy, and FortiSASE - exact patched version numbers were not enumerated in the available data and must be confirmed directly from the advisory. As an immediate compensating control, restrict access to the FortiOS and FortiProxy administrative HTTP interface to a dedicated out-of-band management VLAN accessible only to authorized network administrators; this does not eliminate the vulnerability but effectively removes it from the attack surface for the vast majority of potential attackers, since PR:H already requires privileged credentials and removing network-level reachability stacks an additional barrier. Note that interface restriction may impact legitimate administrative workflows if management is currently performed over in-band paths.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today