---
id: CVE-2026-22627
title: >-
  A buffer copy without checking size of input ('classic buffer overflow')
  vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an
  unauthenticated attacker within the same adjacent network to execute
  unauthorized code…
summary: >-
  A buffer copy without checking size of input ('classic buffer overflow')
  vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an
  unauthenticated attacker within the same adjacent network to execute
  unauthorized code…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-120
vendor: Fortinet
product: FortiSwitchAXFixed
affected:
  - FortiSwitchAXFixed >= 1.0.0 <= 1.0.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-03-12T14:37:35.216423Z'
published: '2026-03-10'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:08.430Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22627'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-086'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-086'
tags:
  - cve.org
epss: 0.00335
epssPercentile: 0.26998
ingestedAt: '2026-11-06T15:54:03.984Z'
---

## Overview

A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an unauthenticated attacker within the same adjacent network to execute unauthorized code or commands on the device via sending a crafted LLDP packet.

## Affected

- `FortiSwitchAXFixed >= 1.0.0 <= 1.0.1`

## Remediation

Upgrade to FortiSwitchAXFixed version 1.0.2 or above