Description
An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiOS | 7.6.0, 7.4.0 – ≤ 7.4.9, 7.2.0 – ≤ 7.2.13, 7.0.0 – ≤ 7.0.19, 6.4.3 – ≤ 6.4.16 | — |
Advisories 4
- WID-SEC-2026-0387 Fortinet FortiOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 27, 2026
- ICSA-26-071-02 Siemens RUGGEDCOM APE1808 Devices CISA ICS & IT advisories · May 14, 2026
- SSA-975644 SSA-975644: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices Siemens ProductCERT · May 12, 2026
- NCSC-2026-0079 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Mar 10, 2026