CVE-2026-59840: 
FortiOS 취약성 분석 및 완화

CVE-2026-59840 is a buffer over-read vulnerability (CWE-126) in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager that may allow an authenticated remote attacker to disclose a portion of device memory via a specially crafted request. Affected products include FortiOS 6.4 all versions through 7.6.3, FortiProxy 7.0 all versions through 7.6.5, FortiPAM 1.0.0 through 1.7.0, and FortiSwitchManager 7.0.0 through 7.2.7. The vulnerability was publicly disclosed on July 14, 2026, and is tracked under Fortinet advisory FG-IR-26-154. It carries a CVSSv3 score of 4.1–4.3 (Medium) (FortiGuard Advisory).

The root cause is a buffer over-read (CWE-126) in FortiOS and FortiProxy's authd and wad daemons. An authenticated attacker can submit a specially crafted request that causes the affected daemon to return a portion of device memory in the redirect response, potentially exposing sensitive data from adjacent memory buffers. Exploitation requires network access and low-level authenticated privileges (PR:L), with no user interaction required. A virtual patch named FG-VD-58646.0day is available in FMWP database update 26.010 (FortiGuard Advisory).

Successful exploitation results in partial information disclosure — specifically, sensitive data from device memory may be leaked to an authenticated attacker via crafted redirect responses. There is no impact on integrity or availability. While the confidentiality impact is rated low and limited in scope, memory disclosures on network security appliances such as FortiOS and FortiProxy could expose credentials, session tokens, or configuration data that facilitate further attacks (FortiGuard Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and Fortinet has confirmed it is not known to be exploited. The EPSS score is approximately 0.00176 (very low probability of exploitation in the near term). Exploitation requires authenticated access with low privileges, reducing the overall risk (FortiGuard Advisory).

1. Authentication: Obtain low-privileged credentials to a vulnerable FortiOS or FortiProxy instance (versions within the affected ranges).
2. Craft malicious request: Construct a specially crafted HTTP/HTTPS request targeting the authd or wad daemon endpoint that triggers the buffer over-read condition.
3. Submit request: Send the crafted request to the management or authentication interface of the affected device over the network.
4. Retrieve memory data: Inspect the redirect response returned by the server, which may contain a portion of adjacent device memory including potentially sensitive data such as credentials, session tokens, or configuration fragments (FortiGuard Advisory).

• Network: Unusual or repeated authenticated requests to FortiOS/FortiProxy authentication or management endpoints generating anomalous redirect responses; unexpected outbound data in HTTP redirect headers.
• Logs: FortiOS/FortiProxy access logs showing repeated crafted requests to authd or wad daemon endpoints from a single authenticated user; error or warning entries in daemon logs related to memory read operations.
• Process: Abnormal behavior or crashes in the authd or wad daemons on affected FortiOS or FortiProxy devices.

Fortinet has released patched versions: FortiOS 7.6.4 or above (for 7.6.x), FortiOS 7.4.9 or above (for 7.4.x); users on FortiOS 7.2, 7.0, and 6.4 should migrate to a fixed release. FortiProxy users should upgrade to 7.6.6 or above (for 7.6.x) or 7.4.14 or above (for 7.4.x); FortiProxy 7.2 and 7.0 users should migrate to a fixed release. A virtual patch (FG-VD-58646.0day) is available in FMWP database update 26.010 for those unable to upgrade immediately. As an additional measure, restrict management interface access to trusted administrators only and implement network segmentation to limit exposure (FortiGuard Advisory).

The vulnerability was reported to Fortinet by Vang3lis and Cyth from VARAS@IIE under responsible disclosure, and Fortinet acknowledged their contribution in the advisory. No significant public researcher commentary, social media discussion, or major media coverage has been identified beyond standard vulnerability tracking aggregators (FortiGuard Advisory).