CVE-2026-84392: 
FortiOS vulnerability analysis and mitigation

CVE-2026-84392 is a NULL Pointer Dereference vulnerability (CWE-476) in Fortinet FortiOS, FortiPAM, and FortiProxy that allows an authenticated attacker to crash the httpsd daemon via crafted HTTP requests, resulting in a denial-of-service condition. Affected products include FortiOS 6.4.x through 7.4.x, FortiPAM 1.0 through 1.9.0, and FortiProxy 7.2.x through 7.6.6. The vulnerability was published on September 8, 2026, and is currently awaiting full NVD analysis. It carries a CVSS v3.1 base score of 2.7 (Low), reflecting the requirement for high-privilege authentication and limited availability impact (Feedly, Fortinet PSIRT).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), occurring within the httpsd daemon of affected Fortinet products. An authenticated attacker can send specially crafted HTTP requests that trigger a null pointer dereference in the daemon, causing it to crash. Exploitation requires network access and high-privilege credentials (e.g., an administrative account), and no user interaction is needed. No public technical write-ups or proof-of-concept code have been identified at this time (Feedly, Fortinet PSIRT).

Successful exploitation causes a crash of the httpsd daemon, disrupting HTTP-based management and web services on affected Fortinet devices. The impact is limited to availability — there is no confidentiality or integrity impact, and the scope is unchanged (confined to the affected component). This could temporarily render the management interface inaccessible, potentially impeding administrative operations on network security appliances (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-84392. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for high-privilege (authenticated) access, making opportunistic mass exploitation unlikely (Feedly).

Fortinet has published advisory FG-IR-26-173 addressing this vulnerability. Administrators should upgrade to fixed versions as recommended by Fortinet: for FortiOS, upgrade beyond the affected 6.4.x, 7.0.x, 7.2.x, and 7.4.x branches; for FortiProxy, upgrade beyond 7.2.x, 7.4.x, and 7.6.6; for FortiPAM, upgrade to a version beyond the affected 1.0–1.9.0 range. As an interim measure, restricting administrative access to the management interface (e.g., limiting access to trusted IP ranges and disabling unnecessary HTTP management exposure) can reduce the attack surface (Fortinet PSIRT).