CVE-2026-84392

A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.

Scoring

Severity

LOW

CVSS base score

2.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

EPSS probability

0.28%

CWE

CWE-476

Published

2026-09-08

Last modified

2026-09-08

Affected products

• Fortinet FortiOS
• Fortinet FortiOS
• Fortinet FortiOS
• Fortinet FortiOS
• Fortinet FortiProxy
• Fortinet FortiProxy
• Fortinet FortiProxy
• Fortinet FortiPAM

Weakness type

• CWE-476

Related vulnerabilities

• CVE-2026-86547 — mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER
• CVE-2026-66303 — Skype for Business and Lync Denial of Service Vulnerability
• CVE-2026-77901 — Microsoft Office Word Remote Code Execution Vulnerability
• CVE-2026-70575 — Windows Schannel Denial of Service Vulnerability
• CVE-2026-69881 — Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
• CVE-2026-69384 — Virtual Hard Disk (VHD) Miniport Driver Denial of Service Vulnerability
• CVE-2026-62762 — Windows Active Directory Domain Services Denial of Service Vulnerability
• CVE-2026-72949 — Windows SMB Server Network Transport Driver (srvnet.sys) Denial of Service Vulnerability

Markdown version · Browse all CVEs