CVE-2026-71407: Stack buffer overflow in WAD
A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 7.6.7 - Upgrade
Upgrade
Fortinet FortiOSto a version that resolves this vulnerability.Fixed in 8.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71407?
The severity of CVE-2026-71407 is medium, with a score of 5.1.
How can I fix CVE-2026-71407?
To fix CVE-2026-71407, ensure you are using the latest version of FortiOS that addresses this vulnerability.
What type of vulnerability is CVE-2026-71407?
CVE-2026-71407 is a Stack-based Buffer Overflow vulnerability.
Who is affected by CVE-2026-71407?
CVE-2026-71407 affects users running Fortinet FortiOS with the explicit proxy configured.
What can an attacker potentially achieve with CVE-2026-71407?
An attacker may execute arbitrary code or commands in the context of the WAD daemon if they exploit CVE-2026-71407.