EUVD-2026-57191
GHSA-32v4-7g7v-4c6p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N for network socket attack; AC:H for mandatory ASLR and stack-canary bypass plus specific Kerberos+SOCKS prerequisite; PR:N since no credentials needed; C/I/A:H for full WAD daemon compromise.
Primary rating from Vendor (fortinet).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.
AnalysisAI
Stack-based buffer overflow in Fortinet FortiOS, FortiProxy, and FortiPAM allows unauthenticated remote attackers to execute arbitrary code or commands within the WAD (Web Application Daemon) process via crafted sockets - but only on devices where the explicit proxy is simultaneously configured with Kerberos authentication and SOCKS enabled. Exploitation further requires defeating stack canary protection and ASLR, elevating real-world attack complexity well above the raw CVSS base score implies. No public exploit or active exploitation has been confirmed; Fortinet PSIRT published advisory FG-IR-26-161 disclosing the issue.
Technical ContextAI
The WAD daemon is Fortinet's Web Application Daemon responsible for explicit proxy processing, SSL/TLS inspection, and application-layer filtering across FortiOS, FortiProxy, and FortiPAM. CWE-121 (Stack-Based Buffer Overflow) indicates a fixed-size stack buffer is overwritten during socket data processing in the explicit proxy code path - specifically the intersection of Kerberos authentication handling and SOCKS proxy negotiation. The CPE strings (cpe:2.3:a:fortinet:fortios, cpe:2.3:a:fortinet:fortipam, cpe:2.3:a:fortinet:fortiproxy) confirm all three product lines share the vulnerable WAD codebase. The CVE description explicitly states that stack protection (canaries) and ASLR must be bypassed, meaning the binary has modern mitigations compiled in - exploitation requires either a separate information-disclosure primitive to leak addresses or a ROP/heap-spray technique to defeat ASLR.
RemediationAI
Patch available per vendor advisory FG-IR-26-161 (https://fortiguard.fortinet.com/psirt/FG-IR-26-161) - upgrade FortiOS beyond 7.6.6, FortiProxy beyond 7.0.23 / 7.2.16 / 7.4.11 / 7.6.4, and FortiPAM beyond the respective 1.x affected ceilings per the advisory; exact fixed release numbers should be verified directly from the Fortinet PSIRT page. As an immediate compensating control, disabling either Kerberos authentication or SOCKS support on the explicit proxy configuration eliminates the exploitable code path - removing either condition is sufficient, though this may break dependent proxy authentication workflows that rely on Kerberos SSO. If neither can be disabled, restrict network access to the proxy ports via perimeter ACLs or firewall policy to limit the attacker population, accepting that this reduces but does not eliminate exposure.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today