This vulnerability is a heap-based buffer overflow in Fortinet FortiSwitchManager (versions 7.2.0 through 7.2.6) and multiple FortiOS versions (7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.0 through 7.0.17, and all 6.4 versions). It allows remote attackers to execute unauthorized code or commands by sending specially crafted packets. The vulnerability has a CVSS 3.1 base score of 7.4, with network attack vector, high complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. The remediation level is currently a workaround, with no official patch published yet.

Successful exploitation can lead to remote code execution without authentication, compromising confidentiality, integrity, and availability of the affected systems. This could allow attackers to execute arbitrary commands or code on vulnerable FortiSwitchManager or FortiOS devices.

Currently, no official patch is available. A workaround is provided by the vendor. Users should apply the vendor-recommended workaround and monitor Fortinet advisories for official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.