Fortinet FortiAnalyzer
At a glance
- Source
- NVD
- EPSS
- EPSS 0.42 % · percentile 37 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- fortinet
- NVD status
- Analyzed
Description
A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager 6.4 all versions may allow an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. This happens if internal locks are aligned, which is out of control of the attacker.
Weaknesses (CWE)
- CWE-676 — Use of Potentially Dangerous Function
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.2 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C | fortinet |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · psirt@fortinet.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-209804
- GCVE · GCVE-0-2025-67604
CERT-FR advisories
- CERTFR-2026-AVI-0575 — Multiples vulnérabilités dans les produits Fortinet · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*≥ 7.2.0 ≤ 7.2.12cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*≥ 7.4.0 < 7.4.9cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*≥ 7.6.0 < 7.6.5cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*≥ 7.2.0 ≤ 7.2.12cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*≥ 7.4.0 < 7.4.9cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*≥ 7.6.0 < 7.6.5
Affected products
| Product | Versions |
|---|---|
| Fortinet · FortiAnalyzer | affected 7.6.0 ≤ 7.6.4 ; affected 7.4.0 ≤ 7.4.8 ; affected 7.2.0 ≤ 7.2.12 ; affected 7.0.0 ≤ 7.0.16 ; affected 6.4.0 ≤ 6.4.15 |
| Fortinet · FortiManager | affected 7.6.0 ≤ 7.6.4 ; affected 7.4.0 ≤ 7.4.8 ; affected 7.2.0 ≤ 7.2.12 ; affected 7.0.0 ≤ 7.0.16 ; affected 6.4.0 ≤ 6.4.15 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |