NULL Pointer Dereference in Fortinet FortiOS and FortiProxy

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Fortinet, Inc.

Description

A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-84392

Affected Vendors & Products

Vendor	Product	Version / Range
fortinet	fortios	7.4
fortinet	fortios	7.2
fortinet	fortipam	1.9.0
fortinet	fortipam	1.8
fortinet	fortipam	1.7
fortinet	fortipam	1.6
fortinet	fortipam	1.5
fortinet	fortipam	1.4
fortinet	fortipam	1.3
fortinet	fortipam	1.2
fortinet	fortipam	1.1
fortinet	fortipam	1.0
fortinet	fortiproxy	From 7.6.0 (inc) to 7.6.6 (inc)
fortinet	fortiproxy	7.4
fortinet	fortiproxy	7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a NULL Pointer Dereference vulnerability affecting Fortinet FortiOS, FortiPAM, and FortiProxy products. It allows an authenticated attacker to crash the httpsd daemon by sending specially crafted HTTP requests.

Impact Analysis

The vulnerability can cause denial of service by crashing the httpsd daemon, leading to service disruption for affected Fortinet products. It requires authentication but could impact availability of network services.

Mitigation Strategies

Upgrade affected Fortinet FortiOS, FortiPAM, and FortiProxy products to the latest patched versions immediately to address the NULL Pointer Dereference vulnerability.

Hi! I’m here to help you understand CVE-2026-84392. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70