This vulnerability is a stack-based buffer overflow present in Fortinet FortiOS versions 7.4.0 through 7.4.1 and 7.2 all versions, as well as FortiPAM versions 1.0.0 through 1.8.0. A privileged authenticated attacker capable of bypassing stack protection and ASLR can exploit this flaw by sending specially crafted HTTP requests, resulting in arbitrary code or command execution. The vulnerability has been assigned CVE-2026-59837 and has a CVSS 3.1 base score of 5.9. The vendor has released an official fix to address this issue.

Successful exploitation allows a privileged authenticated attacker to execute arbitrary code or commands on affected Fortinet FortiPAM and FortiOS systems. This can lead to full compromise of the affected device, impacting confidentiality, integrity, and availability. The attack requires bypassing stack protection and ASLR and privileged authentication, which limits the attack surface.

An official fix is available for this vulnerability. It is recommended to apply the vendor-provided patches promptly to affected FortiPAM and FortiOS versions. Since this is not a cloud service, remediation depends on deploying these updates in the affected environments.