Fortipam
Monthly
Stack-based buffer overflow in Fortinet FortiOS, FortiProxy, and FortiPAM allows unauthenticated remote attackers to execute arbitrary code or commands within the WAD (Web Application Daemon) process via crafted sockets - but only on devices where the explicit proxy is simultaneously configured with Kerberos authentication and SOCKS enabled. Exploitation further requires defeating stack canary protection and ASLR, elevating real-world attack complexity well above the raw CVSS base score implies. No public exploit or active exploitation has been confirmed; Fortinet PSIRT published advisory FG-IR-26-161 disclosing the issue.
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated administrators with read-write permissions to write or delete arbitrary files via malicious CLI commands, potentially compromising system integrity and availability across multiple Fortinet product lines. The vulnerability affects FortiOS 6.4 through 7.6.4, FortiProxy 7.0 through 7.6.4, FortiPAM 1.0 through 1.7.0, and FortiSwitchManager 7.0 through 7.2.7. With a CVSS score of 6.0 a
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Crafted CLI commands fed to the newcli daemon on Fortinet FortiOS - and on the related FortiProxy, FortiSwitch, FortiPAM and FortiSASE platforms that share the code base - trigger a double free that crashes the daemon, giving a local, highly privileged authenticated administrator a low-impact denial of service. Exploitation requires an interactive, already-authenticated administrative CLI session, with no remote, unauthenticated or default-configuration path; no public exploit has been identified at time of analysis. At CVSS 2.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), this is a low-priority, low-real-risk issue despite being a named CVE.
Authenticated denial of service in Fortinet FortiOS, FortiPAM, and FortiProxy allows a high-privileged network attacker to crash the httpsd daemon by sending specially crafted HTTP requests, exploiting a NULL pointer dereference (CWE-476). The vulnerability spans FortiOS 7.2.x and 7.4.x, FortiProxy 7.2 through 7.6.6, and every FortiPAM release from 1.0.0 through 1.9.0. No active in-the-wild exploitation is confirmed, but the CVSS temporal metric E:P indicates proof-of-concept code exists; Fortinet has released an official fix under advisory FG-IR-26-173.
Buffer over-read in Fortinet FortiOS and FortiProxy exposes sensitive memory contents to authenticated network attackers across multiple product lines including FortiPAM and FortiSwitchManager. The flaw, rooted in CWE-126 (buffer over-read), allows low-privileged remote users to read beyond allocated buffer boundaries, resulting in partial information disclosure with no integrity or availability impact. No active exploitation confirmed in CISA KEV, but the CVSS temporal vector includes E:P indicating proof-of-concept exploit code exists, and an official fix is available per RL:O.
Reflected or stored cross-site scripting in Fortinet FortiOS, FortiPAM, and FortiProxy web interfaces allows a remote unauthenticated attacker to execute JavaScript in the browser session of an authenticated administrator via crafted HTTP requests. The CVSS temporal metric E:P confirms publicly available proof-of-concept exploit code exists, and the RL:O metric confirms Fortinet has released an official fix. No active exploitation has been confirmed by CISA KEV at time of analysis, but the combination of a POC and the high-value targets (network security appliances and privileged access management systems) elevates real-world risk beyond what the base CVSS score of 6.1 suggests.
Path traversal (CWE-22) in Fortinet FortiOS, FortiProxy, and FortiPAM enables a highly-privileged, physically-present attacker to execute unauthorized code or commands by escaping restricted directory boundaries. The vendor-supplied CVSS vector (AV:P/PR:H) constrains exploitation to scenarios requiring both physical device access and high-level credentials, making opportunistic or remote mass exploitation implausible. A proof-of-concept exists per the CVSS temporal indicator (E:P), and Fortinet has released an official fix per PSIRT advisory FG-IR-26-151; this vulnerability is not currently listed in the CISA KEV catalog.
HTTP Response Splitting in Fortinet FortiOS and FortiProxy captive portal authentication flows enables a man-in-the-middle attacker to inject arbitrary HTTP headers into intercepted authentication requests. Affected platforms span FortiOS 7.2-7.6.4 and FortiProxy 7.2-7.6.4. The CVSS temporal vector includes E:P, confirming proof-of-concept exploit code exists; however, no active exploitation has been confirmed via CISA KEV. The RL:O temporal indicator confirms an official remediation is available per vendor advisory FG-IR-26-153.
HTTP Response Splitting in Fortinet FortiOS and FortiProxy enables an attacker who holds a valid web filter override token to inject arbitrary HTTP headers into server responses by tricking a user into clicking a crafted link. Affected versions span FortiOS 7.2 through 7.6.4 and FortiProxy 7.2 through 7.6.4. No active exploitation has been confirmed by CISA KEV, though the CVSS temporal vector includes E:P, indicating partial proof-of-concept evidence exists. Real-world impact is constrained by the requirement to possess a valid web filter override token and to achieve user interaction.
Stack-based buffer overflow in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSASE enables arbitrary code execution for a privileged authenticated attacker capable of bypassing ASLR and stack canary protections via crafted HTTP requests. The CVSS temporal metric E:P confirms proof-of-concept exploit code exists, and RL:O confirms an official patch has been released by Fortinet (advisory FG-IR-26-148). This vulnerability is not listed in CISA KEV at time of analysis, and the dual prerequisites of privileged access plus memory-protection bypass substantially constrain real-world exploitability despite the critical CIA impact triad.
A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS. Rated low severity (CVSS 1.9). No vendor patch available.
Authenticated heap-based buffer overflow in FortiOS, FortiPAM, and FortiProxy RDP bookmark handling can allow a low-privileged user to execute unauthorized code. Affected deployments include FortiOS 7.6.2 and below, 7.4.7 and below, 7.2.10 and below, and all 7.0/6.4 branches; FortiPAM through 1.5.0; and FortiProxy 7.6.2/7.4.3 and below and all 7.2/7.0 branches. No public exploit identified at time of analysis, and EPSS is low at 0.08%, though CVSS 8.8 reflects high confidentiality, integrity, and availability impact once an attacker holds valid low-privilege credentials and can reach the RDP bookmark feature.
Unauthenticated remote attackers can exploit weak authentication in Fortinet FortiPAM and FortiSwitchManager management interfaces to execute unauthorized code or commands via specially crafted HTTP requests. Affected builds include FortiPAM 1.0 through 1.5.0 (notably 1.5.0, 1.4.0-1.4.2, and all 1.1/1.2/1.3 releases) and FortiSwitchManager 7.2.0 through 7.2.4; the CVSS vector is network-reachable, low-complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact (9.8). No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is 0.58% (47th percentile), so observed risk is driven mainly by whether the management interface is exposed.
Privilege escalation in Fortinet FortiOS, FortiProxy, FortiPAM, FortiSRA, and FortiSwitchManager allows an attacker who already holds administrative access to the management interface to trigger a heap-based buffer overflow through crafted HTTP requests and gain elevated privileges. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), making it a post-authentication escalation primitive rather than an initial-access vector. No public exploit was identified at time of analysis, and EPSS is low at 0.56% (45th percentile).
A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiPAM 1.1 all versions, FortiPAM. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
A security vulnerability in Fortinet FortiPAM 1.4.0 (CVSS 6.3) that allows attacker. Remediation should follow standard vulnerability management procedures.
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14, FortiPAM version 1.2.0, 1.1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stack-based buffer overflow in Fortinet FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiWeb, FortiAuthenticator, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.1 through. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions,. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions,. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attacker to perform a denial of service attack via sending crafted. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stack-based buffer overflow in Fortinet FortiOS, FortiProxy, and FortiPAM allows unauthenticated remote attackers to execute arbitrary code or commands within the WAD (Web Application Daemon) process via crafted sockets - but only on devices where the explicit proxy is simultaneously configured with Kerberos authentication and SOCKS enabled. Exploitation further requires defeating stack canary protection and ASLR, elevating real-world attack complexity well above the raw CVSS base score implies. No public exploit or active exploitation has been confirmed; Fortinet PSIRT published advisory FG-IR-26-161 disclosing the issue.
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated administrators with read-write permissions to write or delete arbitrary files via malicious CLI commands, potentially compromising system integrity and availability across multiple Fortinet product lines. The vulnerability affects FortiOS 6.4 through 7.6.4, FortiProxy 7.0 through 7.6.4, FortiPAM 1.0 through 1.7.0, and FortiSwitchManager 7.0 through 7.2.7. With a CVSS score of 6.0 a
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Crafted CLI commands fed to the newcli daemon on Fortinet FortiOS - and on the related FortiProxy, FortiSwitch, FortiPAM and FortiSASE platforms that share the code base - trigger a double free that crashes the daemon, giving a local, highly privileged authenticated administrator a low-impact denial of service. Exploitation requires an interactive, already-authenticated administrative CLI session, with no remote, unauthenticated or default-configuration path; no public exploit has been identified at time of analysis. At CVSS 2.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), this is a low-priority, low-real-risk issue despite being a named CVE.
Authenticated denial of service in Fortinet FortiOS, FortiPAM, and FortiProxy allows a high-privileged network attacker to crash the httpsd daemon by sending specially crafted HTTP requests, exploiting a NULL pointer dereference (CWE-476). The vulnerability spans FortiOS 7.2.x and 7.4.x, FortiProxy 7.2 through 7.6.6, and every FortiPAM release from 1.0.0 through 1.9.0. No active in-the-wild exploitation is confirmed, but the CVSS temporal metric E:P indicates proof-of-concept code exists; Fortinet has released an official fix under advisory FG-IR-26-173.
Buffer over-read in Fortinet FortiOS and FortiProxy exposes sensitive memory contents to authenticated network attackers across multiple product lines including FortiPAM and FortiSwitchManager. The flaw, rooted in CWE-126 (buffer over-read), allows low-privileged remote users to read beyond allocated buffer boundaries, resulting in partial information disclosure with no integrity or availability impact. No active exploitation confirmed in CISA KEV, but the CVSS temporal vector includes E:P indicating proof-of-concept exploit code exists, and an official fix is available per RL:O.
Reflected or stored cross-site scripting in Fortinet FortiOS, FortiPAM, and FortiProxy web interfaces allows a remote unauthenticated attacker to execute JavaScript in the browser session of an authenticated administrator via crafted HTTP requests. The CVSS temporal metric E:P confirms publicly available proof-of-concept exploit code exists, and the RL:O metric confirms Fortinet has released an official fix. No active exploitation has been confirmed by CISA KEV at time of analysis, but the combination of a POC and the high-value targets (network security appliances and privileged access management systems) elevates real-world risk beyond what the base CVSS score of 6.1 suggests.
Path traversal (CWE-22) in Fortinet FortiOS, FortiProxy, and FortiPAM enables a highly-privileged, physically-present attacker to execute unauthorized code or commands by escaping restricted directory boundaries. The vendor-supplied CVSS vector (AV:P/PR:H) constrains exploitation to scenarios requiring both physical device access and high-level credentials, making opportunistic or remote mass exploitation implausible. A proof-of-concept exists per the CVSS temporal indicator (E:P), and Fortinet has released an official fix per PSIRT advisory FG-IR-26-151; this vulnerability is not currently listed in the CISA KEV catalog.
HTTP Response Splitting in Fortinet FortiOS and FortiProxy captive portal authentication flows enables a man-in-the-middle attacker to inject arbitrary HTTP headers into intercepted authentication requests. Affected platforms span FortiOS 7.2-7.6.4 and FortiProxy 7.2-7.6.4. The CVSS temporal vector includes E:P, confirming proof-of-concept exploit code exists; however, no active exploitation has been confirmed via CISA KEV. The RL:O temporal indicator confirms an official remediation is available per vendor advisory FG-IR-26-153.
HTTP Response Splitting in Fortinet FortiOS and FortiProxy enables an attacker who holds a valid web filter override token to inject arbitrary HTTP headers into server responses by tricking a user into clicking a crafted link. Affected versions span FortiOS 7.2 through 7.6.4 and FortiProxy 7.2 through 7.6.4. No active exploitation has been confirmed by CISA KEV, though the CVSS temporal vector includes E:P, indicating partial proof-of-concept evidence exists. Real-world impact is constrained by the requirement to possess a valid web filter override token and to achieve user interaction.
Stack-based buffer overflow in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSASE enables arbitrary code execution for a privileged authenticated attacker capable of bypassing ASLR and stack canary protections via crafted HTTP requests. The CVSS temporal metric E:P confirms proof-of-concept exploit code exists, and RL:O confirms an official patch has been released by Fortinet (advisory FG-IR-26-148). This vulnerability is not listed in CISA KEV at time of analysis, and the dual prerequisites of privileged access plus memory-protection bypass substantially constrain real-world exploitability despite the critical CIA impact triad.
A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS. Rated low severity (CVSS 1.9). No vendor patch available.
Authenticated heap-based buffer overflow in FortiOS, FortiPAM, and FortiProxy RDP bookmark handling can allow a low-privileged user to execute unauthorized code. Affected deployments include FortiOS 7.6.2 and below, 7.4.7 and below, 7.2.10 and below, and all 7.0/6.4 branches; FortiPAM through 1.5.0; and FortiProxy 7.6.2/7.4.3 and below and all 7.2/7.0 branches. No public exploit identified at time of analysis, and EPSS is low at 0.08%, though CVSS 8.8 reflects high confidentiality, integrity, and availability impact once an attacker holds valid low-privilege credentials and can reach the RDP bookmark feature.
Unauthenticated remote attackers can exploit weak authentication in Fortinet FortiPAM and FortiSwitchManager management interfaces to execute unauthorized code or commands via specially crafted HTTP requests. Affected builds include FortiPAM 1.0 through 1.5.0 (notably 1.5.0, 1.4.0-1.4.2, and all 1.1/1.2/1.3 releases) and FortiSwitchManager 7.2.0 through 7.2.4; the CVSS vector is network-reachable, low-complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact (9.8). No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is 0.58% (47th percentile), so observed risk is driven mainly by whether the management interface is exposed.
Privilege escalation in Fortinet FortiOS, FortiProxy, FortiPAM, FortiSRA, and FortiSwitchManager allows an attacker who already holds administrative access to the management interface to trigger a heap-based buffer overflow through crafted HTTP requests and gain elevated privileges. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), making it a post-authentication escalation primitive rather than an initial-access vector. No public exploit was identified at time of analysis, and EPSS is low at 0.56% (45th percentile).
A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiPAM 1.1 all versions, FortiPAM. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
A security vulnerability in Fortinet FortiPAM 1.4.0 (CVSS 6.3) that allows attacker. Remediation should follow standard vulnerability management procedures.
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14, FortiPAM version 1.2.0, 1.1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stack-based buffer overflow in Fortinet FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiWeb, FortiAuthenticator, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.1 through. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions,. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions,. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attacker to perform a denial of service attack via sending crafted. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.