CVE-2026-71407: 
FortiOS Analisi e mitigazione delle vulnerabilità

CVE-2026-71407 is a stack-based buffer overflow (CWE-121) in Fortinet FortiOS's explicit proxy component that may allow an unauthenticated remote attacker to execute arbitrary code or commands in the context of the WAD (Web Application Daemon) daemon. It affects FortiOS versions 7.6.1 through 7.6.6, as well as FortiProxy (7.0.0–7.0.23, 7.2.0–7.2.16, 7.4.0–7.4.11, 7.6.0–7.6.4) and FortiPAM (1.0.0–1.8.4 across multiple branches). Exploitation requires the attacker to bypass stack protection and ASLR, and is only possible when the explicit proxy is configured with Kerberos authentication and SOCKS enabled. The vulnerability was publicly disclosed on August 12, 2026, and carries a CVSSv3.1 base score of 5.6 (Medium) per NVD, or 5.1 (Medium) per Fortinet's own advisory (Fortinet PSIRT, GitHub Advisory).

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), residing in the WAD daemon of FortiOS's explicit proxy implementation. An attacker can send crafted sockets to the WAD daemon to overflow a stack-allocated buffer, potentially overwriting the return address or control data to redirect execution flow. However, successful exploitation requires bypassing modern mitigations — specifically stack canaries/stack protection and Address Space Layout Randomization (ASLR) — making exploitation significantly more complex. The attack vector is network-based, requires no authentication, and no user interaction, but the specific precondition of Kerberos authentication combined with SOCKS proxy being enabled substantially narrows the attack surface (Fortinet PSIRT, GitHub Advisory).

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code or commands within the context of the WAD daemon process on affected FortiOS, FortiProxy, and FortiPAM systems. The impact spans low-level confidentiality, integrity, and availability compromise — an attacker gaining code execution in the WAD daemon could intercept or manipulate proxied traffic, potentially enabling lateral movement within the network. The scope is limited to the affected component (unchanged scope), but compromise of a network security appliance like FortiOS could have significant downstream consequences for protected environments (Fortinet PSIRT).

As of the disclosure date (August 12, 2026), there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Fortinet PSIRT). The EPSS score is 0.0, reflecting very low current exploitation probability, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The requirement to bypass both stack protection and ASLR significantly raises the exploitation bar, and the attack is only feasible under a specific non-default configuration (explicit proxy with Kerberos + SOCKS). The vulnerability was reported to Fortinet by the UK's National Cyber Security Centre (NCSC) under responsible disclosure (Fortinet PSIRT).

Fortinet has released FortiOS 7.6.7 as the patched version for affected FortiOS 7.6.x deployments; FortiOS 7.4, 7.2, and 8.0 are not affected. For FortiProxy and FortiPAM, administrators should consult Fortinet's upgrade path tool at https://docs.fortinet.com/upgrade-tool for appropriate target versions. As an immediate workaround, administrators can disable the SOCKS proxy (config web-proxy explicit → set socks disable) or modify the authentication scheme for the SOCKS proxy to remove Kerberos authentication via config authentication rule and config authentication scheme settings. A virtual patch named FG-VD-10009617.0day is also available in FMWP database update 26.073 for environments that cannot immediately upgrade (Fortinet PSIRT).

The vulnerability was reported by the UK's National Cyber Security Centre (NCSC) to Fortinet under responsible disclosure, indicating coordinated handling prior to public release (Fortinet PSIRT). No significant public researcher commentary, social media discussion, or notable media coverage has been identified at this time, consistent with the low EPSS score and absence of active exploitation.