Vulnerability · Published Aug 12, 2026 · Assigned by fortinet
CVE-2026-71407
Medium 5.1
In plain English
A medium-severity stack buffer overflow in FortiOS from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiOS | 7.6.1 – through 7.6.6 |
| Fortinet | FortiPAM | 1.8.0 – through 1.8.41.7.0 – through 1.7.21.6.0 – through 1.6.21.5.0 – through 1.5.11.4.0 – through 1.4.31.3.0 – through 1.3.11.2.01.1.0 – through 1.1.2 |
| Fortinet | FortiProxy | 7.6.0 – through 7.6.47.4.0 – through 7.4.117.2.0 – through 7.2.167.0.0 – through 7.0.23 |
Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C