CVE-2026-59840CWE-126

CVE-2026-59840

Medium · published July 14, 2026

CVSS v3.1

4.3

EPSS

Percentile

23.0

In the wild

Unconfirmed

What it is

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack vector here>

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00313 · 23.0th percentile
Weakness: CWE-126 · Buffer Over-read
Published: 2026-07-14T20:17Z

Affected products (4)

Product	Versions	Fixed in
fortinet/fortiproxy	≥ 7.2.0, < 7.4.14	7.4.14
fortinet/fortiproxy	≥ 7.6.0, < 7.6.6	7.6.6
fortinet/fortios	≥ 7.2.0, < 7.4.9	7.4.9
fortinet/fortios	≥ 7.6.0, ≤ 7.6.2	—

References (2)

https://fortiguard.fortinet.com/psirt/FG-IR-26-154 · [email protected]https://cert-portal.siemens.com/productcert/html/ssa-864900.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

EPSS history

Timeline

14 JUL 15:19Z
A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions…
cvelistv5