CVE-2026-84392
Awaiting Analysis
Awaiting Analysis - Queue
NULL Pointer Dereference in Fortinet FortiOS and FortiProxy
Vulnerability report for CVE-2026-84392, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-08
Last updated on: 2026-09-08
Assigner: Fortinet, Inc.
Description
Description
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fortinet | fortios | 7.4 |
| fortinet | fortios | 7.2 |
| fortinet | fortipam | 1.9.0 |
| fortinet | fortipam | 1.8 |
| fortinet | fortipam | 1.7 |
| fortinet | fortipam | 1.6 |
| fortinet | fortipam | 1.5 |
| fortinet | fortipam | 1.4 |
| fortinet | fortipam | 1.3 |
| fortinet | fortipam | 1.2 |
| fortinet | fortipam | 1.1 |
| fortinet | fortipam | 1.0 |
| fortinet | fortiproxy | From 7.6.0 (inc) to 7.6.6 (inc) |
| fortinet | fortiproxy | 7.4 |
| fortinet | fortiproxy | 7.2 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
