CVE-2026-84391
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow an attacker to cause denial of service. The attack vector is not specified.
Risk Assessment
An attacker could exploit this vulnerability to disrupt FortiAnalyzer service, potentially impacting the availability of security monitoring and analysis in the organization.
Recommendation
It is recommended to update FortiAnalyzer to a patched version if available. Also restrict access to the device to trusted users and monitor for unusual behavior.
Other vulnerabilities in FortiAnalyzer
See all- CVE-2025-46773High
An SQL Injection vulnerability (CWE-89) in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, 7.4.1 through 7.4.7, and 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.
- CVE-2025-61848High
An SQL injection vulnerability in Fortinet FortiAnalyzer, FortiManager and related products (listed versions) may allow a privileged authenticated attacker to execute unauthorized code or commands via JSON RPC API.
- CVE-2025-54973Medium
A race condition vulnerability in Fortinet FortiAnalyzer allows an attacker to bypass FortiCloud SSO authorization via crafted requests. Affects versions 7.0.0-7.0.13, 7.2.0-7.2.10, 7.4.0-7.4.6, 7.6.0-7.6.2.
- CVE-2024-50571High
A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy allows an attacker to execute unauthorized code or commands via specifically crafted requests.
Original NVD description (English source)
A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of service via <insert attack vector here>
Vulnerability data from NVD (NIST) · CISA KEV · EPSS