FortinetCVE-2026-59840
Fortinet FortiOS: information disclosure
Medium4.3CVE-2026-59840 · Published Jul 14, 2026 · updated Aug 11, 2026
A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack vector here>
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| FortiOS Product | >= 7.6.0, <= 7.6.3 | No fix yet |
| >= 7.4.0, <= 7.4.8 | No fix yet | |
| >= 7.2.0, <= 7.2.13 | No fix yet | |
| >= 7.0.0, <= 7.0.19 | No fix yet | |
| FortiPAM Product | <= 1.7.0 | No fix yet |
| >= 1.6.0, <= 1.6.2 | No fix yet | |
| >= 1.5.0, <= 1.5.1 | No fix yet | |
| >= 1.4.0, <= 1.4.3 | No fix yet | |
| FortiProxy Product | >= 7.6.0, <= 7.6.5 | No fix yet |
| >= 7.4.0, <= 7.4.13 | No fix yet | |
| >= 7.2.0, <= 7.2.16 | No fix yet | |
| >= 7.0.0, <= 7.0.23 | No fix yet | |
| FortiSwitchManager Product | >= 7.2.0, <= 7.2.7 | No fix yet |
| >= 7.0.0, <= 7.0.6 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-126
More Fortinet advisories
All Fortinet| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 14 | Fortinet FortiOS: path traversal | Medium5.5 | No fix yet |
| Jul 14 | Fortinet FortiSIEMWindowsAgent: privilege escalation | High7.5 | No fix yet |
| Jul 14 | Fortinet FortiSandbox: unauthenticated attacker could access the VNC server of... | High8.6 | No fix yet |
| Jul 14 | Fortinet FortiClientEMS: improper certificate validation | High7.5 | No fix yet |
| Jul 14 | Fortinet FortiOS: stack buffer overflow | Medium6.6 | No fix yet |
| Jul 14 | Fortinet FortiOS: cross-site scripting | Medium6.1 | No fix yet |