---
id: CVE-2026-59840
title: >-
  A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3,
  FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all
  versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy
  7.4.0 through…
summary: >-
  A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3,
  FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all
  versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy
  7.4.0 through…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-126
vendor: fortinet
product: fortiproxy
affected:
  - 'fortiproxy >= 7.2.0, < 7.4.14'
  - 'fortiproxy >= 7.6.0, < 7.6.6'
  - 'fortios >= 7.2.0, < 7.4.9'
  - 'fortios >= 7.6.0, <= 7.6.2'
patched:
  - fortiproxy 7.6.6
  - fortios 7.4.9
published: '2026-07-14'
updated: '2026-07-16'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59840'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-154'
    label: psirt@fortinet.com
tags:
  - nvd
  - cve.org
epss: 0.00313
epssPercentile: 0.2405
ingestedAt: '2026-07-17T13:12:08.465Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-14T15:57:19.678421Z'
scores:
  nvd: 4.3
  cna: 4.1
---

## Overview

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack vector here>

## Affected

- `fortiproxy >= 7.2.0, < 7.4.14`
- `fortiproxy >= 7.6.0, < 7.6.6`
- `fortios >= 7.2.0, < 7.4.9`
- `fortios >= 7.6.0, <= 7.6.2`

## Remediation

Upgrade past the affected range:

- `fortiproxy 7.6.6`
- `fortios 7.4.9`