CVE-2026-59839 Overview
CVE-2026-59839 is a path traversal vulnerability [CWE-22] affecting Fortinet FortiOS, FortiProxy, and FortiPAM products. The flaw stems from improper limitation of a pathname to a restricted directory. An authenticated attacker with high privileges and physical access can leverage the vulnerability to execute unauthorized code or commands on affected devices. The issue impacts multiple long-standing branches of Fortinet's operating system and proxy platforms, including end-of-support versions.
Critical Impact
An attacker with physical access and high privileges can execute unauthorized code or commands, resulting in complete loss of integrity and availability on the affected Fortinet device.
Affected Products
- Fortinet FortiOS 6.4 (all versions), 7.0 (all versions), 7.2 (all versions), 7.4.0 through 7.4.9, and 7.6.0 through 7.6.6
- Fortinet FortiProxy 7.0 (all versions), 7.2 (all versions), 7.4 through 7.4.13, and 7.6.0 through 7.6.5
- Fortinet FortiPAM 1.0 through 1.7.2 and 1.8.0
Discovery Timeline
- 2026-07-14 - CVE-2026-59839 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-59839
Vulnerability Analysis
The vulnerability is classified as a path traversal weakness under [CWE-22]. Fortinet's software fails to properly restrict pathnames used in file operations to an intended directory. An attacker who supplies specially crafted path sequences can traverse outside the expected directory boundary and interact with files that should remain inaccessible. Successful exploitation allows the attacker to execute unauthorized code or commands within the appliance's operating environment.
Exploitation requires physical access to the device and high existing privileges. User interaction is not required. The scope remains unchanged, but the confidentiality impact is none while integrity and availability are both fully impacted. This profile suggests the attacker can write to or replace files that alter device behavior without directly reading protected data.
The EPSS score is 0.208%, placing the vulnerability in the 11th percentile for exploitation likelihood. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is insufficient validation and canonicalization of file path inputs handled by administrative or privileged interfaces of FortiOS, FortiProxy, and FortiPAM. When path input containing traversal sequences such as ../ is passed to file operations without normalization, the application resolves the path outside the intended restricted directory.
Attack Vector
The attack vector is physical (AV:P), meaning the attacker must have direct physical interaction with the device, typically through a console or local management port. Attack complexity is low, and the attacker must already possess high privileges on the target system. Refer to the Fortinet PSIRT Report FG-IR-26-151 for vendor-specific technical detail.
No verified exploit code is publicly available. See the Fortinet PSIRT advisory for authoritative technical context.
Detection Methods for CVE-2026-59839
Indicators of Compromise
- Unexpected files created or modified outside standard FortiOS, FortiProxy, or FortiPAM directories.
- Console or local management sessions from privileged accounts followed by unusual configuration changes.
- System logs referencing file operations containing traversal sequences such as ../ or encoded variants.
Detection Strategies
- Review Fortinet device audit logs for administrative sessions initiated over local console interfaces.
- Correlate privileged account activity with subsequent file system or configuration integrity changes.
- Monitor firmware and configuration hashes to detect unauthorized modification of on-device files.
Monitoring Recommendations
- Forward FortiOS, FortiProxy, and FortiPAM syslog data to a centralized log platform for retention and correlation.
- Alert on administrative logins occurring outside change windows or from physical console ports.
- Track privileged account inventory and periodically reconcile against active administrators.
How to Mitigate CVE-2026-59839
Immediate Actions Required
- Restrict physical access to Fortinet devices by placing appliances in locked racks or secured rooms.
- Enforce strict inventory and rotation controls for high-privilege administrator credentials.
- Upgrade affected FortiOS, FortiProxy, and FortiPAM installations to fixed versions identified by Fortinet.
Patch Information
Fortinet has published remediation guidance in the Fortinet PSIRT advisory FG-IR-26-151. Administrators should consult the advisory for the specific fixed builds corresponding to each affected branch of FortiOS, FortiProxy, and FortiPAM, and plan upgrade windows accordingly. End-of-support versions such as FortiOS 6.4 and 7.2 should be migrated to a supported release.
Workarounds
- Limit the number of accounts holding high administrative privilege on affected devices.
- Disable or restrict local console access when not required for operational tasks.
- Enable multi-factor authentication for administrative accounts to reduce credential misuse risk.
# Configuration example - refer to Fortinet PSIRT FG-IR-26-151 for authoritative guidance
# Verify current firmware version prior to upgrade planning
get system status
# Review administrator accounts and privilege levels
show system admin
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
