CVE-2026-84392: Denial of service in Fortinet FortiOS
Description
CVE-2026-84392 is a low-severity denial of service vulnerability in multiple Fortinet products including FortiOS, FortiPAM, and FortiProxy. It involves a NULL Pointer Dereference that can be triggered by an authenticated attacker sending crafted HTTP requests to crash the httpsd daemon. The vulnerability affects numerous versions across these products. An official fix is available to address this issue.
CVSS v3.1
Score 2.5low
Affected software
Fortinet
FortiOS
Fortinet
FortiProxy
Fortinet
FortiPAM
cpe:2.3:a:fortinet:fortiproxy:7.6.6:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiproxy:7.6.5:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiproxy:7.6.4:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiproxy:7.6.3:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiproxy:7.6.2:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiproxy:7.6.1:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-84392) is a NULL Pointer Dereference in Fortinet FortiOS, FortiPAM, and FortiProxy products. It allows an authenticated attacker to cause a denial of service by crashing the httpsd daemon through crafted HTTP requests. The affected versions include FortiOS 6.4.0 through 7.6.6 (specific subversions), FortiPAM versions 1.0.0 through 1.9.0, and FortiProxy versions 7.4 and 7.6.0 through 7.6.6. The CVSS v3.1 base score is 2.5, indicating low severity. The vendor has released official fixes for the affected versions.
Potential Impact
An authenticated attacker can cause a denial of service by crashing the httpsd daemon on affected Fortinet products. This results in service disruption but does not impact confidentiality or integrity. There are no known exploits in the wild at this time.
Mitigation Recommendations
An official fix is available from Fortinet for all affected versions. Users should apply the vendor-provided patches to remediate this vulnerability. Since the vulnerability requires authentication, ensuring strong access controls and applying the official patches will mitigate the risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- fortinet
- Date Reserved
- 2026-09-01T16:36:13.308Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- official-fix
Threat ID: 6aa03d6bacd9273b49f0b440
Added to database: 09/08/2026, 16:52:59 UTC
Last enriched: 10/15/2026, 19:32:13 UTC
Last updated: 10/23/2026, 15:10:15 UTC
Views: 253
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.