Stack-based buffer overflow in FortiOS - CVE-2026-71407
Published: August 13, 2026
Vulnerability identifier: #VU142457
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-71407
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to stack-based buffer overflow in WAD. An unauthenticated attacker who can bypass stack protection and aslr can execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.
Affected software
FortiOS
How to mitigate CVE-2026-71407
Install update from vendor's website.
FortiOS - update to 7.6.7