CVE-2026-59837
MediumCVSS 6.6Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A stack-based buffer overflow in Fortinet FortiOS, FortiPAM and FortiProxy may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.
Risk Assessment
A privileged attacker may execute arbitrary code on the device, potentially leading to full compromise of the system and network traffic.
Recommendation
Update FortiOS, FortiPAM and FortiProxy to patched versions and restrict administrative access.
Other vulnerabilities in FortiOS
See all- CVE-2015-7361High
FortiOS version 5.2.3, when configured for High Availability (HA) with the dedicated management interface enabled, does not require authentication for access to the ZebOS shell on this interface. This allows remote attackers to gain shell access via unspecified vectors.
- CVE-2025-68686MediumActively exploited
A vulnerability in Fortinet FortiOS allows a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases. The attack requires prior compromise of the product via another vulnerability at the filesystem level.
- CVE-2025-24472HighActively exploited
An authentication bypass vulnerability in FortiOS and FortiProxy allows a remote unauthenticated attacker, with prior knowledge of upstream and downstream device serial numbers, to gain super-admin privileges on the downstream device if Security Fabric is enabled. The attack is carried out via crafted CSF proxy requests.
- CVE-2024-55591CriticalActively exploited
An authentication bypass vulnerability in FortiOS and FortiProxy using an alternate path or channel. A remote attacker can gain super-admin privileges by sending crafted requests to the Node.js websocket module.
- CVE-2023-42789Critical
An out-of-bounds write vulnerability in Fortinet FortiOS, FortiProxy, and FortiSASE allows an attacker to execute unauthorized code or commands via specially crafted HTTP requests.
- CVE-2022-40684CriticalActively exploited
An authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager allows an unauthenticated attacker to perform operations on the administrative interface via crafted HTTP or HTTPS requests.
- CVE-2021-44168LowActively exploited
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
- CVE-2019-5591MediumActively exploited
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
- CVE-2020-12812CriticalActively exploited
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
- CVE-2019-6693MediumActively exploited
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
Original NVD description (English source)
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS