FortiOS FortiProxy FortiPAM CVE-2026-71407

Three simultaneous deployment conditions must all be true: (1) the explicit proxy feature must be enabled on the target FortiOS/FortiProxy/FortiPAM device; (2) that explicit proxy must be configured to use Kerberos authentication; and (3) SOCKS proxy support must also be active on the same explicit proxy instance. Additionally, the attacker must independently defeat stack canary protection and ASLR - the CVE description explicitly states both mitigations are present and must be bypassed, meaning exploitation is not possible without a separate memory-disclosure primitive or equivalent capability. Explicit proxy with Kerberos plus SOCKS is a non-default, enterprise-specific configuration pattern uncommon in typical deployments. Limiting factors beyond configuration: restricted to FortiOS 7.6.1-7.6.6 and specific FortiPAM/FortiProxy version ranges; AC:H exploitation complexity; no known public exploit chain.

The vendor CVSS of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) is well-calibrated: AC:H honestly captures the dual bypass requirement (stack canary + ASLR), and PR:N reflects that no credentials are needed once the exploitable configuration is present. EPSS at 0.49% (40th percentile) is low and consistent with the non-trivial exploitation barrier. SSVC rates Automatable as 'no' - confirming that mass-scanning or worm-style exploitation is not feasible due to the configuration prerequisite and mitigation-bypass requirement. However, SSVC Technical Impact is rated 'total', meaning successful exploitation fully compromises the WAD process, which handles all proxy traffic and can expose decrypted session content. Despite no KEV listing, Fortinet appliances are high-priority targets for nation-state threat actors who routinely invest in multi-stage exploit chains. The narrow configuration requirement (explicit proxy + Kerberos + SOCKS simultaneously) substantially reduces the exploitable population but does not eliminate risk for enterprises using Kerberos-authenticated proxy architectures.

An advanced attacker identifies a Fortinet perimeter device configured for explicit proxy with both Kerberos authentication and SOCKS enabled, then sends crafted socket data designed to overflow the WAD stack buffer. The attacker must first obtain a memory address leak or deploy a ROP chain to defeat ASLR and stack canary protections before the overflow yields code execution - placing this firmly in the skilled/nation-state attacker category. No public exploit code exists at time of analysis.