EUVD-2026-72930
GHSA-ww3q-4pw6-jh9g
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
High-privilege authentication required to reach httpsd; crash causes only transient low availability impact with no confidentiality or integrity loss.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.
AnalysisAI
Authenticated denial of service in Fortinet FortiOS, FortiPAM, and FortiProxy allows a high-privileged network attacker to crash the httpsd daemon by sending specially crafted HTTP requests, exploiting a NULL pointer dereference (CWE-476). The vulnerability spans FortiOS 7.2.x and 7.4.x, FortiProxy 7.2 through 7.6.6, and every FortiPAM release from 1.0.0 through 1.9.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: (1) network-layer access to the httpsd management interface (TCP 443 or the configured management port), and (2) a valid authenticated session with high-privilege (administrator-level) credentials on the targeted appliance - PR:H in the CVSS vector confirms this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This vulnerability carries a low CVSS base score of 2.5, driven by the PR:H (high-privilege) authentication requirement and the A:L (low availability) impact - even a mid-sized municipal IT team in inowroclaw would not typically treat this as an emergency-response priority given the constrained attacker population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the official vendor patch per Fortinet PSIRT advisory FG-IR-26-173 (https://fortiguard.fortinet.com/psirt/FG-IR-26-173); the CVSS temporal metric RL:O confirms a fix has been released, and the advisory specifies the exact upgrade targets for each product branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today