CVE-2026-71408: 
FortiOS vulnerability analysis and mitigation

CVE-2026-71408 is an allocation of resources without limits or throttling vulnerability (CWE-770) in Fortinet FortiOS that may allow an unauthenticated remote attacker to cause a denial of service condition. The vulnerability affects FortiOS versions 6.4.0–6.4.16, 7.0.0–7.0.19, 7.2.0–7.2.13, 7.4.0–7.4.12, and 7.6.0–7.6.6. It was published on August 12, 2026, with Fortinet's advisory tracked as FG-IR-26-162. The CVSS v3.1 base score is 5.3 (Medium) (Fortinet PSIRT, GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning FortiOS fails to impose adequate restrictions on the size or number of resources allocated in response to certain network requests. An unauthenticated attacker can exploit this over the network with low attack complexity and no user interaction required, triggering resource exhaustion on the affected device. The specific attack vector (e.g., the protocol or endpoint targeted) has not been publicly disclosed in available sources, as the official advisory description contains a placeholder (<insert attack vector here>). No public proof-of-concept code has been identified (Fortinet PSIRT, GitHub Advisory).

Successful exploitation results in a denial of service condition on the affected FortiOS device, degrading or interrupting availability of network security functions such as firewall, VPN, and routing services. The impact is limited to availability (rated Low in CVSS), with no confidentiality or integrity impact identified. Because FortiOS devices typically serve as network perimeter security appliances, availability disruption could indirectly expose downstream network segments (Fortinet PSIRT, GitHub Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of active in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability is rated automatable by NVD SSVC analysis, meaning exploitation could be scripted without manual interaction. The EPSS score is approximately 0.556% (44th percentile), indicating a relatively low near-term exploitation probability. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog based on available data (Fortinet PSIRT).

Fortinet has issued a patch under advisory FG-IR-26-162; administrators should consult the official Fortinet PSIRT page for specific fixed version numbers and apply available updates promptly (Fortinet PSIRT). As interim mitigations, organizations should implement network-based rate limiting and access controls to restrict traffic to FortiOS management and data-plane interfaces, reducing exposure to resource exhaustion attacks. Deploying intrusion prevention systems capable of detecting abnormal traffic volumes targeting FortiOS devices can provide additional defense-in-depth while patching is underway.

Security news outlets including CyberSecurityNews, GBHackers, and Cryptika covered this vulnerability as part of broader reporting on Fortinet's August 2026 patch release addressing multiple authentication and other vulnerabilities across FortiWeb, FortiManager, and FortiClient products (CyberSecurityNews, GBHackers). Community discussion on Infosec.Exchange noted the vulnerability alongside other Fortinet disclosures from the same advisory cycle. No significant independent researcher commentary or vendor statements beyond the official advisory have been identified.