CyberCVE

CVE-2025-43892

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authent

Severity
Medium 4.1
CVSS 3.1
Exploited
Not listed
EPSS
0.003
24.1th percentile
Discovered by
Not disclosed
Published
Jul 14, 2026
Assigned by fortinet

Description

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request.

Weakness: CWE-126

Affected products

Vendor Product Category Matched by
Fortinet FortiOS Firewall / NGFW cna-assigner
Vendor-reported affected versions (1)
  • Fortinet · FortiOS

Vendor remediation

Upgrade to FortiOS version 7.6.4 or above Upgrade to FortiOS version 7.4.9 or above Fortinet remediated this issue in FortiSASE version 25.4.b and hence customers do not need to perform any action. Upgrade to FortiProxy version 7.6.6 or above Upgrade to FortiProxy version 7.4.14 or above

References