EUVD-2026-43719
GHSA-r538-x648-7vg8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable with low complexity, low-privilege auth required per PR:L, limited to confidentiality-only impact with no integrity or availability effect.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>
AnalysisAI
Buffer over-read in Fortinet FortiOS and FortiProxy exposes sensitive memory contents to authenticated network attackers across multiple product lines including FortiPAM and FortiSwitchManager. The flaw, rooted in CWE-126 (buffer over-read), allows low-privileged remote users to read beyond allocated buffer boundaries, resulting in partial information disclosure with no integrity or availability impact. No active exploitation confirmed in CISA KEV, but the CVSS temporal vector includes E:P indicating proof-of-concept exploit code exists, and an official fix is available per RL:O.
Technical ContextAI
CWE-126 (Buffer Over-read) describes a condition where a program reads data past the end of an allocated buffer, potentially exposing adjacent memory contents such as stack data, heap metadata, or sensitive application state. This class of vulnerability is distinct from buffer overflows (CWE-121/122) in that it typically does not allow arbitrary code execution but can leak cryptographic material, session tokens, or configuration data. The affected products span Fortinet's enterprise security portfolio: FortiOS (the operating system underpinning FortiGate firewalls and VPN appliances), FortiProxy (explicit web and SSL inspection proxy), FortiPAM (privileged access management), and FortiSwitchManager (network switch management). CPE strings confirm all four product families are in scope. The specific network-level protocol or feature path triggering the over-read is redacted in the published description (the attack vector field contains a literal placeholder), so the exact parsing component has not been publicly disclosed at time of analysis.
RemediationAI
An official patch is available per the CVSS temporal metric RL:O, confirmed by Fortinet's PSIRT advisory FG-IR-26-154 at https://fortiguard.fortinet.com/psirt/FG-IR-26-154. Exact fixed version numbers were not disclosed in the input data and must be confirmed directly from the advisory before deploying upgrades. Administrators should upgrade FortiOS and FortiProxy to the vendor-specified fixed releases for each affected branch (7.2, 7.4, 7.6) as a primary remediation action. As a compensating control pending patch deployment, restricting management-plane and affected service access to trusted source IPs via firewall policy or local-in policies reduces exposure for authenticated attack paths - though this does not eliminate risk if attackers already possess valid low-privilege credentials. Reviewing and revoking unnecessary low-privilege accounts on affected appliances limits the attacker's ability to satisfy the PR:L prerequisite. Monitor Fortinet's PSIRT portal for updated guidance as the specific attack vector remains undisclosed in public documentation.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Arbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today