FortinetCVE-2026-84392
Fortinet FortiOS: null pointer dereference
Low2.7CVE-2026-84392 · Published Sep 8, 2026
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| FortiOS Product | >= 7.4.0, <= 7.4.12 | No fix yet |
| >= 7.2.0, <= 7.2.13 | No fix yet | |
| >= 7.0.0, <= 7.0.19 | No fix yet | |
| >= 6.4.0, <= 6.4.16 | No fix yet | |
| FortiPAM Product | <= 1.9.0 | No fix yet |
| >= 1.8.0, <= 1.8.4 | No fix yet | |
| >= 1.7.0, <= 1.7.2 | No fix yet | |
| >= 1.6.0, <= 1.6.2 | No fix yet | |
| FortiProxy Product | >= 7.6.0, <= 7.6.6 | No fix yet |
| >= 7.4.0, <= 7.4.14 | No fix yet | |
| >= 7.2.0, <= 7.2.16 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-476
More Fortinet advisories
All Fortinet| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 8 | Fortinet FortiSOAR PaaS: improper access control | Medium5.4 | No fix yet |
| Sep 8 | Fortinet FortiClientWindows: improper access control | Medium5.1 | No fix yet |
| Sep 8 | Fortinet FortiSandbox: command injection | High7.2 | No fix yet |
| Sep 8 | Fortinet FortiSIEM: open redirect | Low3.1 | No fix yet |
| Sep 8 | Fortinet FortiAnalyzer: denial of service | Medium6.5 | No fix yet |
| Sep 8 | Fortinet FortiOS: information disclosure | High8.1 | No fix yet |