CVE-2025-55018CWE-444

An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2…

Medium · published February 10, 2026

CVSS v3.1
5.2
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header

The record
Technical detail
CVSS v3.1
5.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00402 · 33.3th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-02-10T15:39Z
EPSS history
Timeline
  • 10 FEB 15:39Z
    An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2…
    cvelistv5