CVE-2026-71408: 
FortiOS Analisi e mitigazione delle vulnerabilità

CVE-2026-71408 is an Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Fortinet FortiOS that allows an unauthenticated attacker to perform a slow HTTP Denial of Service (DoS) attack against the FortiOS web management interface via crafted HTTP requests. The vulnerability affects FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 (all versions), FortiOS 7.2 (all versions), FortiOS 7.0.0 through 7.0.19, and FortiOS 6.4.0 through 6.4.16; FortiOS 8.0 is not affected. It was publicly disclosed on August 12, 2026, and is noted as a regression from a previously patched issue (FG-IR-19-013). The CVSS v3.1 base score is 5.3 (Medium) (Fortinet PSIRT, Github Advisory).

The root cause is CWE-770 — the FortiOS web interface (GUI) fails to impose limits or throttling on resource allocation when processing incoming HTTP requests, enabling a slow HTTP DoS attack pattern. An unauthenticated, network-adjacent attacker can send specially crafted HTTP requests that cause the system to allocate resources indefinitely without releasing them, eventually exhausting available resources. No authentication or user interaction is required, and the attack vector is entirely network-based. Fortinet notes this is a regression from FG-IR-19-013, indicating the original fix was incomplete or bypassed in subsequent versions. Starting with FortiOS 7.6.7 and 8.0.0, new configuration commands (admin-http-request-header-timeout, admin-http-request-body-timeout, admin-http-unauthenticated-request-body-timeout) are available to enforce timeout thresholds (Fortinet PSIRT).

Successful exploitation results in a Denial of Service condition on the FortiOS device's web management interface, degrading or completely disrupting administrative access. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because the attack targets the management GUI, sustained exploitation could prevent administrators from managing FortiGate devices, potentially impacting network security posture and operational continuity (Fortinet PSIRT, Github Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date (Fortinet PSIRT). The vulnerability is classified as "automatable" by NVD SSVC analysis, meaning exploitation could be scripted without manual interaction. The EPSS score is 0.0, reflecting very low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify FortiGate devices with internet-facing management GUI (HTTPS on port 443 or 8443) running affected FortiOS versions (6.4.x, 7.0.x, 7.2.x, 7.4.x, or 7.6.0–7.6.6) using tools such as Shodan or Censys.
2. Initiate slow HTTP attack: Using a tool such as Slowloris or a custom HTTP client, open multiple simultaneous HTTP connections to the FortiOS web management interface without completing the HTTP request (e.g., sending headers very slowly or withholding the final CRLF).
3. Exhaust resources: Maintain these incomplete connections to prevent the server from releasing allocated resources, gradually consuming available connection slots or memory on the target device.
4. Achieve DoS: Once resources are exhausted, the FortiOS management GUI becomes unresponsive or unavailable to legitimate administrators, achieving the denial of service objective (Fortinet PSIRT).

• Network: High volume of long-lived, incomplete HTTP connections to the FortiOS management interface (port 443/8443) from one or more source IPs; connections that remain open without completing HTTP headers or body transmission.
• Logs: FortiOS system logs showing repeated connection attempts or resource exhaustion warnings from the web GUI component; unusual spikes in concurrent HTTP sessions in the management interface logs.
• Process/System: Degraded responsiveness or complete unavailability of the FortiOS web management interface; administrator login failures due to GUI unresponsiveness despite the device being otherwise operational.

Fortinet has released FortiOS 7.6.7 as the patched version for the 7.6.x branch; users on FortiOS 7.4 and 7.2 (all versions) should migrate to a fixed release using the Fortinet upgrade path tool at https://docs.fortinet.com/upgrade-tool. FortiOS 8.0 is not affected. As an immediate workaround, Fortinet recommends restricting administrator logins to trusted hosts only and disabling GUI access on internet-facing interfaces. On patched versions (7.6.7+ and 8.0.0+), configure timeout thresholds using: config system global → set admin-http-request-header-timeout, set admin-http-request-body-timeout, set admin-http-unauthenticated-request-body-timeout (Fortinet PSIRT).

The vulnerability was reported to Fortinet by Iván Domínguez from Zerolynx under responsible disclosure, and Fortinet acknowledged the report in their advisory (Fortinet PSIRT). Community tracking was observed on VulDB and security aggregators shortly after disclosure, but no significant public researcher commentary or media coverage has been identified beyond standard vulnerability database entries.