CVE-2026-71408: 
FortiOS vulnerability analysis and mitigation

CVE-2026-71408 is an allocation of resources without limits or throttling vulnerability (CWE-770) in Fortinet FortiOS that may allow an unauthenticated remote attacker to cause a denial of service condition. The vulnerability affects FortiOS 7.6.0 through 7.6.6, 7.4.0 through 7.4.12, 7.2.0 through 7.2.13, 7.0.0 through 7.0.19, and 6.4.0 through 6.4.16. It was published on August 12, 2026, and assigned by Fortinet under advisory FG-IR-26-162. The CVSS v3.1 base score is 5.3 (Medium) (Fortinet PSIRT, GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning FortiOS fails to impose adequate restrictions on the size or number of resources allocated in response to certain network requests. An unauthenticated attacker can exploit this over the network with low attack complexity and no user interaction required, triggering resource exhaustion on the affected device. The specific attack vector (e.g., the protocol or endpoint targeted) has not been publicly disclosed in available advisories — the official description contains a placeholder (<insert attack vector here>), indicating details may be withheld pending broader patch availability. No public proof-of-concept code has been identified (Fortinet PSIRT, GitHub Advisory).

Successful exploitation results in a denial of service condition on the affected FortiOS device, degrading or interrupting availability of network security functions such as firewall, VPN, and routing services. The impact is limited to availability (rated Low in CVSS), with no confidentiality or integrity impact. Because FortiOS devices typically serve as network perimeter security appliances, a sustained DoS could expose downstream network segments to increased risk during the outage period (Fortinet PSIRT, GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept as of the time of publication (GitHub Advisory). The vulnerability is rated as automatable (no user interaction, no authentication required), which lowers the barrier for opportunistic exploitation. The EPSS score is approximately 0.556%, placing it in the 44th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

Fortinet has issued advisory FG-IR-26-162 addressing this vulnerability; organizations should consult the advisory directly for patched version information, as specific fixed version numbers were not publicly detailed in available sources at time of writing (Fortinet PSIRT). As interim mitigations, administrators should implement network-based rate limiting and access controls to restrict traffic to FortiOS management and data-plane interfaces, and deploy intrusion prevention systems capable of detecting resource exhaustion patterns. Restricting access to FortiOS interfaces to trusted IP ranges via firewall rules or management ACLs can significantly reduce the attack surface.

Coverage of CVE-2026-71408 has been largely aggregated alongside a broader set of Fortinet authentication vulnerability patches disclosed in the same release cycle, with outlets such as CyberSecurityNews, GBHackers, and Cryptika reporting on the overall Fortinet patch batch rather than this specific CVE in isolation (CyberSecurityNews, GBHackers). Community discussion on platforms such as Infosec.Exchange has been limited, consistent with the moderate severity rating and absence of active exploitation. No notable independent researcher commentary specific to this CVE has been identified.