FG-IR-26-173: Null Pointer Dereference in Log Report
Published Sep 8, 2026
·Updated
A NULL Pointer Dereference vulnerability [CWE-476] in FortiOS, FortiProxy and FortiPAM may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.
Affected Software
17 affected componentsFixes available
Fortinet FortiOS>=7.4
Fortinet FortiOS>=7.2
Fortinet FortiOS>=7.0
Fortinet FortiOS>=6.4
Fortinet FortiPAM=.
Fortinet FortiPAM>=1.8
Fortinet FortiPAM>=1.7
Fortinet FortiPAM>=1.6
Fortinet FortiPAM>=1.5
Fortinet FortiPAM>=1.4
Fortinet FortiPAM>=1.3
Fortinet FortiPAM>=1.2
Fortinet FortiPAM>=1.1
Fortinet FortiPAM>=1.0
Fortinet FortiProxy>=7.6.0<=7.6.6
Fortinet FortiProxy>=7.4
Fortinet FortiProxy>=7.2
Event History
Sep 8, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software