Advisoriesby IbisFortinetCVE-2026-59840
Fortinet FortiOS: information disclosure
No fix yet
A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack vector here>
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| FortiOS Product | >= 7.6.0, <= 7.6.3 | No fix yet |
| >= 7.4.0, <= 7.4.8 | No fix yet | |
| >= 7.2.0, <= 7.2.13 | No fix yet | |
| >= 7.0.0, <= 7.0.19 | No fix yet | |
| FortiPAM Product | <= 1.7.0 | No fix yet |
| >= 1.6.0, <= 1.6.2 | No fix yet | |
| >= 1.5.0, <= 1.5.1 | No fix yet | |
| >= 1.4.0, <= 1.4.3 | No fix yet | |
| FortiProxy Product | >= 7.6.0, <= 7.6.5 | No fix yet |
| >= 7.4.0, <= 7.4.13 | No fix yet | |
| >= 7.2.0, <= 7.2.16 | No fix yet | |
| >= 7.0.0, <= 7.0.23 | No fix yet | |
| FortiSwitchManager Product | >= 7.2.0, <= 7.2.7 | No fix yet |
| >= 7.0.0, <= 7.0.6 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-126