EUVD-2026-43717
GHSA-c97x-2x9j-68c3
Severity by source
AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Physical access vector and high privileges are consistent with a local management console path traversal; no confidentiality impact as described.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0, FortiPAM 1.7.0 through 1.7.2, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
AnalysisAI
Path traversal (CWE-22) in Fortinet FortiOS, FortiProxy, and FortiPAM enables a highly-privileged, physically-present attacker to execute unauthorized code or commands by escaping restricted directory boundaries. The vendor-supplied CVSS vector (AV:P/PR:H) constrains exploitation to scenarios requiring both physical device access and high-level credentials, making opportunistic or remote mass exploitation implausible. A proof-of-concept exists per the CVSS temporal indicator (E:P), and Fortinet has released an official fix per PSIRT advisory FG-IR-26-151; this vulnerability is not currently listed in the CISA KEV catalog.
Technical ContextAI
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes a class of flaw where unsanitized user-supplied path components - such as '../' sequences - allow traversal outside the intended filesystem boundary, potentially enabling reads, writes, or command execution in privileged directories. The affected products span three distinct Fortinet platforms: FortiOS (the core operating system for Fortinet firewalls and NGFW appliances), FortiProxy (secure web gateway/proxy appliance), and FortiPAM (privileged access management solution). CPE strings confirm all three product families under the fortinet vendor namespace. The CVSS vector specifies AV:P (physical access vector), meaning the path traversal is reachable only through a locally-present interface - likely a management console, CLI, or local filesystem operation - rather than via a network-exposed API. The specific attack vector disclosed in the description is a placeholder ('<insert attack vector here>'), meaning the precise delivery mechanism has not been publicly documented in available input data.
RemediationAI
Patch available per vendor advisory (FG-IR-26-151) - consult https://fortiguard.fortinet.com/psirt/FG-IR-26-151 for exact fixed versions for each affected product branch, as the specific patched release numbers are not independently confirmed from available input data. The CVSS temporal indicator RL:O confirms an official fix has been released. As a compensating control pending patching, restrict physical access to FortiOS, FortiPAM, and FortiProxy appliances by enforcing datacenter physical security controls (locked racks, access logs) and reducing the number of accounts with high-privilege access to management interfaces - this directly addresses the AV:P/PR:H exploitation prerequisites. Review privileged user accounts on affected appliances and audit console/CLI session logs for anomalous path references. Note that restricting physical access does not eliminate the vulnerability but raises the bar for exploitation to a level most threat actors cannot realistically meet.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today