Log in Start free

Vulnerability · Published Jul 14, 2026 · Assigned by fortinet

CVE-2025-62826

Low 3.1

In plain English

A low-severity security flaw in FortiOS from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.4%top 68.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker able to intercept and modify a user's captive portal authentication request to inject arbitrary headers via crafted HTTP requests.

Affected products (as reported)

VendorProductVersions
Fortinet FortiPAM 1.7.01.6.0 – through 1.6.21.5.0 – through 1.5.11.4.0 – through 1.4.31.3.0 – through 1.3.11.2.01.1.0 – through 1.1.21.0.0 – through 1.0.3
Fortinet FortiProxy 7.6.0 – through 7.6.47.4.0 – through 7.4.147.2.0 – through 7.2.167.0.0 – through 7.0.23
Fortinet FortiOS 7.6.0 – through 7.6.27.4.0 – through 7.4.87.2.0 – through 7.2.137.0.0 – through 7.0.196.4.0 – through 6.4.16

Weakness: CWE-113 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

References