EUVD-2026-57191
GHSA-32v4-7g7v-4c6p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
RCE in the WAD daemon on a network proxy appliance warrants C:H/I:H/A:H; AC:H reflects mandatory ASLR and stack-canary bypass plus restrictive config prerequisites.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.
AnalysisAI
Stack-based buffer overflow in the WAD (Web Application Detection) daemon of Fortinet FortiOS 7.6.1-7.6.6, FortiProxy across multiple 7.x branches, and FortiPAM across numerous 1.x releases enables remote unauthenticated code execution in the daemon's context. Exploitation requires a non-default but operationally plausible configuration - explicit proxy with both Kerberos authentication and SOCKS enabled - and additionally demands the attacker defeat stack protection and ASLR. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two non-default configuration conditions to be simultaneously active: (1) the explicit proxy feature must be enabled and (2) that explicit proxy must be configured with Kerberos authentication AND SOCKS enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS base score of 5.1 (Medium) appears substantially understated relative to the described impact of arbitrary code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | An official patch is confirmed available (CVSS temporal RL:O); apply the vendor-released fix for FortiOS, FortiProxy, and FortiPAM per the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-161 - exact patched version numbers should be obtained directly from that advisory as they were not enumerated in the provided dataset. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Arbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today