CVE-2026-59839: 
FortiOS 취약성 분석 및 완화

CVE-2026-59839 is a path traversal vulnerability (CWE-22) in Fortinet FortiOS, FortiPAM, and FortiProxy that may allow a privileged authenticated attacker with physical access to delete the file system via crafted CLI commands. It was published on July 14, 2026, and reported by the UK's National Cyber Security Centre (NCSC) under responsible disclosure. Affected products include FortiOS 6.4 through 7.6.6, FortiPAM 1.0 through 1.8.0, and FortiProxy 7.0 through 7.6.5. The vulnerability carries a CVSSv3 score of 5.0 (Medium) (Fortinet PSIRT).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and resides in the CLI component of the affected Fortinet products. An attacker can craft specific CLI commands that traverse outside the intended restricted directory, potentially reaching and deleting files on the root file system. Exploitation requires physical access to the device and high-privilege authentication, making the attack vector physical (AV:P) with high privileges required (PR:H). No public proof-of-concept or detailed technical write-up has been disclosed beyond the vendor advisory (Fortinet PSIRT).

Successful exploitation allows a privileged attacker with physical device access to delete arbitrary files on the root file system, potentially rendering the device inoperable or disrupting network security services. The primary impacts are high integrity and high availability loss, with no direct confidentiality impact noted in the CVSS scoring. Given that FortiOS and FortiProxy serve as network security gateways, file system deletion could result in complete service outage and potential exposure of the protected network (Fortinet PSIRT).

There is no evidence of public proof-of-concept code or active in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and Fortinet's advisory confirms it is not known to be exploited. The EPSS score is approximately 0.0021 (0.21%), reflecting low near-term exploitation probability. The attack is not automatable due to the physical access and high-privilege requirements (Fortinet PSIRT).

Fortinet has released patched versions and recommends upgrading as follows: FortiOS to 7.6.7 or above (for 7.6.x), 7.4.10 or above (for 7.4.x); FortiOS 7.2, 7.0, and 6.4 users should migrate to a fixed release branch. FortiPAM users should upgrade to 1.8.1 or above (for 1.8.x) or 1.7.3 or above (for 1.7.x); all earlier FortiPAM versions require migration to a fixed release. FortiProxy users should upgrade to 7.6.6 or above (for 7.6.x) or 7.4.14 or above (for 7.4.x); FortiProxy 7.2 and 7.0 users must migrate to a fixed release. A virtual patch named "FG-VD-60139.0day" is available in FMWP database update 26.021 for environments that cannot immediately upgrade. Organizations should also enforce strict physical access controls to limit exposure (Fortinet PSIRT).

The vulnerability was reported by the UK's National Cyber Security Centre (NCSC) under responsible disclosure, indicating coordinated handling. Security news outlets including CyberSecurityNews, GBHackers, and CyberPress covered the broader Fortinet patch release addressing seven vulnerabilities, of which CVE-2026-59839 was one. Community reaction has been measured given the physical access requirement, with no significant alarm or widespread discussion observed (Fortinet PSIRT).