Description
An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions RDP bookmark connection may allow an authenticated user to execute unauthorized code via crafted requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiPAM | 1.5.0, 1.4.0 – ≤ 1.4.2, 1.3.0 – ≤ 1.3.1, 1.2.0, 1.1.0 – ≤ 1.1.2, 1.0.0 – ≤ 1.0.3 | — |
| Fortinet | FortiProxy | 7.6.0 – ≤ 7.6.2, 7.4.0 – ≤ 7.4.3, 7.2.0 – ≤ 7.2.15, 7.0.0 – ≤ 7.0.22 | — |
| Fortinet | FortiOS | 7.6.0 – ≤ 7.6.2, 7.4.0 – ≤ 7.4.7, 7.2.0 – ≤ 7.2.10, 7.0.0 – ≤ 7.0.18, 6.4.0 – ≤ 6.4.16 | — |
Advisories 4
- SSA-864900 SSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Oct 13, 2026
- ICSA-25-135-01 Siemens RUGGEDCOM APE1808 Devices CISA ICS & IT advisories · Jul 9, 2026
- NCSC-2025-0324 Kwetsbaarheid verholpen in FortiOS NCSC-NL (Netherlands) · Oct 17, 2025
- WID-SEC-2025-2286 Fortinet FortiOS und FortiProxy: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 14, 2025