Description
An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiOS | 7.6.0 – ≤ 7.6.1, 7.4.0 – ≤ 7.4.6, 7.2.0 – ≤ 7.2.10, 7.0.0 – ≤ 7.0.16, 6.4.0 – ≤ 6.4.16 | — |
| Fortinet | FortiProxy | 7.6.0 – ≤ 7.6.3, 7.4.0 – ≤ 7.4.10, 7.2.0 – ≤ 7.2.14, 7.0.0 – ≤ 7.0.23 | — |
Advisories 2
- SSA-864900 SSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2026-1837 Fortinet FortiOS und FortiProxy: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jun 9, 2026