FortiOS CVE-2026-59839

Physical access to the device (AV:P) is required - remote exploitation over a network is not possible based on the vendor-supplied CVSS vector. Additionally, high-privilege credentials (PR:H) must be held by the attacker, meaning the exploiting party must already be an authenticated administrator or operator-level user on the affected appliance. The specific feature, protocol, or configuration setting through which the path traversal is triggered is not disclosed in available data (the description's attack vector field is a template placeholder). Exploitation is limited by: (1) requirement for physical presence at the device, (2) requirement for high-level credentials, and (3) no confidentiality impact (C:N), meaning data exfiltration is not a direct outcome - integrity and availability of the affected system are the primary impacts.

The CVSS base score of 5.0 (Medium) reflects the severe access constraints encoded in the vector: AV:P requires the attacker to have physical proximity to the device, and PR:H requires high-level credentials, meaning the attacker must already be a privileged operator. Despite the I:H and A:H impact ratings - which indicate full integrity and availability compromise of the affected system - these prerequisites drastically limit the real-world attacker population. No CISA KEV listing exists, meaning active exploitation has not been confirmed at scale. The temporal indicator E:P confirms a proof-of-concept exploit exists, but the RL:O (Official Fix) indicator shows Fortinet has already released a patch, reducing exposure for patched environments. The EPSS score is not provided in the input data, leaving probabilistic exploitation likelihood unquantifiable from this dataset. The primary real-world risk scenario is an insider threat or a physically-present authorized user abusing path traversal to elevate impact beyond their intended role - not an external remote attacker. CVSS signals and description are consistent: both indicate a physically-local, high-privilege requirement.

A privileged administrator or malicious insider with physical or console access to an affected Fortinet appliance crafts a path traversal payload (e.g., a filename or parameter containing '../' sequences) through a locally-accessible management interface. The application fails to canonicalize or restrict the path, allowing the attacker to reference files or execute commands outside the intended directory. A proof-of-concept for this technique is confirmed by the CVSS temporal indicator E:P, meaning the attack mechanics are likely documented in researcher tooling.