High · published January 13, 2026
CVSS calls it high at 8.1. It is confirmed in active exploitation. It sits in the 90.0th percentile for exploit probability.
⚡ A heap-based buffer overflow vulnerability lurking in Fortinet FortiOS could let attackers execute unauthorized commands! 🔥 Think of it like a delivery crew that suddenly starts accepting packages without checking the contents. If they get a malicious parcel labeled as a priority delivery, they might just unload anything — including some nasty surprises — right into the system! This vulnerability allows an attacker to run arbitrary code, potentially gaining complete control over the affected device. If exploited, it could lead to a complete system compromise, risking sensitive data and critical operations. This is absolutely devastating for anyone relying on Fortinet's infrastructure!
Think of it like a delivery crew that suddenly starts accepting packages without checking the contents. If they get a malicious parcel labeled as a priority delivery, they might just unload anything — including some nasty surprises — right into the system! The vulnerability arises from a heap-based buffer overflow in multiple versions of FortiOS and FortiSwitchManager. By sending specially crafted packets, an attacker could manipulate memory and execute unauthorized commands.
This vulnerability allows an attacker to run arbitrary code, potentially gaining complete control over the affected device. If exploited, it could lead to a complete system compromise, risking sensitive data and critical operations. This is absolutely devastating for anyone relying on Fortinet's infrastructure! To secure your system, upgrade FortiOS to versions 7.6.4, 7.4.9, 7.2.12, 7.0.18 or 6.4.11 immediately. For FortiSwitchManager, update to versions 7.2.7 or 7.0.6. Regularly audit your network for any unintended exposure. 🛡️ You've got this! Follow these steps and you’ll have your systems fortified in no time! 🚀
| Product | Versions | Fixed in |
|---|---|---|
| fortinet/fortios | ≥ 6.4.0, < 7.0.18 | 7.0.18 |
| fortinet/fortios | ≥ 7.2.0, < 7.2.12 | 7.2.12 |
| fortinet/fortios | ≥ 7.4.0, < 7.4.9 | 7.4.9 |
| fortinet/fortios | ≥ 7.6.0, < 7.6.4 | 7.6.4 |
| fortinet/fortiswitchmanager | ≥ 7.0.0, < 7.0.6 | 7.0.6 |
| fortinet/fortiswitchmanager | ≥ 7.2.0, < 7.2.7 | 7.2.7 |
| fortinet/fortisase | all versions | — |
| fortinet/fortisase | all versions | — |
| siemens/ruggedcom_ape1808_firmware | all versions | — |