FG-IR-26-172: Uncontrolled Resource Consumption in SNMP

Q: Who can exploit this issue?

A remote attacker must be authenticated and have user-level permission. The attack is performed against the FortiAnalyzer SNMP daemon using SNMP GETBULK requests.

Q: What is the impact of successful exploitation?

Successful exploitation may cause a denial of service. The provided information does not indicate any confidentiality or integrity impact.

Q: Is user interaction required?

No user interaction is required. Exploitation has low attack complexity but requires network access and authenticated user permissions.

Published Sep 8, 2026

Updated

A Use of Uninitialized Variable [CWE-457] vulnerability in Fortinet FortiAnalyzer SNMP daemon may allow a remote authenticated attacker with user permission to cause a denial of service via SNMP GETBULK requests.

Affected Software

1 affected componentFixes available

Fortinet FortiAnalyzer>=7.6.3<=7.6.6

Event History

Sep 8, 2026

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must be authenticated and have user-level permission. The attack is performed against the FortiAnalyzer SNMP daemon using SNMP GETBULK requests.

What is the impact of successful exploitation?

Successful exploitation may cause a denial of service. The provided information does not indicate any confidentiality or integrity impact.

Is user interaction required?

No user interaction is required. Exploitation has low attack complexity but requires network access and authenticated user permissions.

FG-IR-26-172: Uncontrolled Resource Consumption in SNMP

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Is user interaction required?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Is user interaction required?