CVE-2026-59840: Fortinet FortiProxy Info Disclosure Bug

CVE-2026-59840 Overview

CVE-2026-59840 is a buffer over-read vulnerability [CWE-126] affecting multiple versions of Fortinet FortiOS and FortiProxy. The flaw allows an authenticated remote attacker with low privileges to trigger information disclosure by reading memory beyond an allocated buffer. Fortinet published the advisory on July 14, 2026, tracked as FG-IR-26-154. The vulnerability is exploitable over the network without user interaction, but it does not impact integrity or availability.

Critical Impact
Authenticated attackers can extract sensitive memory contents from FortiOS and FortiProxy devices, potentially exposing configuration data, credentials, or session artifacts.

Affected Products

Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and all versions of 7.2, 7.0, and 6.4
Fortinet FortiProxy 7.6.0 through 7.6.5, 7.4.0 through 7.4.13, and all versions of 7.2 and 7.0
Fortinet security appliances relying on the affected FortiOS or FortiProxy code paths

Discovery Timeline

2026-07-14 - CVE-2026-59840 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-59840

Vulnerability Analysis

The vulnerability is a buffer over-read classified under [CWE-126]. During processing of an attacker-supplied input, the affected FortiOS and FortiProxy components read past the end of an allocated buffer. The out-of-bounds data returned to the requester exposes adjacent process memory. Because the read occurs within an authenticated context, an attacker must first obtain valid low-privileged credentials or session access to the device management or proxy interface.

The scope is unchanged and only confidentiality is affected. No integrity modification or denial of service results from a single exploitation attempt. Repeated invocations, however, can enumerate residual memory content and disclose secrets stored in adjacent structures.

Root Cause

The root cause is missing or incorrect boundary validation on a length field or index used when copying data out of an internal buffer. When the length parameter exceeds the actual buffer size, the code continues reading contiguous memory. Fortinet has not disclosed the specific handler in its public advisory. Refer to the Fortinet Security Advisory FG-IR-26-154 for vendor-supplied technical detail.

Attack Vector

The attack vector is network-based and requires authentication. An attacker sends a crafted request to an affected FortiOS or FortiProxy service, causing the vulnerable handler to return over-read memory in its response. No user interaction is required. No public proof-of-concept or exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.18%.

See the Fortinet Security Advisory FG-IR-26-154 for technical detail on the affected component.

Detection Methods for CVE-2026-59840

Indicators of Compromise

Repeated authenticated requests from a single source targeting the same FortiOS or FortiProxy endpoint with abnormal length or offset parameters
Unusually large or malformed response payloads returned from administrative or proxy service endpoints
Unexpected authentication activity from low-privileged accounts on management interfaces

Detection Strategies

Enable verbose logging on FortiOS and FortiProxy management planes and forward logs to a central analytics platform for anomaly review
Baseline normal request patterns for administrative APIs and alert on outliers in request size, frequency, or parameter values
Correlate authentication events with subsequent request bursts to identify credential-abuse patterns preceding disclosure attempts

Monitoring Recommendations

Restrict management and proxy interface exposure to trusted networks, then monitor those networks for unexpected client sources
Track outbound data volume from Fortinet appliances to detect sustained memory harvesting attempts
Review Fortinet PSIRT advisories on a scheduled cadence and align monitoring rules with newly disclosed indicators

How to Mitigate CVE-2026-59840

Immediate Actions Required

Inventory all FortiOS and FortiProxy instances and identify versions matching the affected ranges
Upgrade to the fixed versions listed in the Fortinet advisory FG-IR-26-154
Rotate credentials and API tokens used on affected devices in case memory disclosure exposed them
Restrict administrative and proxy interfaces to management networks only

Patch Information

Fortinet has released fixed builds documented in the Fortinet Security Advisory FG-IR-26-154. Administrators should consult the advisory for the exact fixed version corresponding to each affected release train and follow the vendor upgrade path. FortiOS 6.4, 7.0, and 7.2 branches are listed as affected in all versions and may require migration to a supported major release.

Workarounds

Limit access to FortiOS and FortiProxy management and proxy interfaces using trusted-host restrictions and firewall policy
Enforce multi-factor authentication on all administrative accounts to raise the barrier for the required authenticated access
Disable unused services and API endpoints on affected devices until patching is complete
Monitor Fortinet PSIRT for updates to FG-IR-26-154 covering additional mitigations

bash

# Example: restrict FortiGate admin access to a trusted management subnet
config system admin
    edit "admin"
        set trusthost1 10.10.10.0 255.255.255.0
    next
end