CVE-2026-71408: Fortinet FortiOS DoS Vulnerability

CVE-2026-71408 Overview

CVE-2026-71408 is a resource allocation without limits or throttling vulnerability [CWE-770] in Fortinet FortiOS. The flaw affects FortiOS versions 7.6.0 through 7.6.6, all versions of FortiOS 7.4, and all versions of FortiOS 7.2. An unauthenticated remote attacker can trigger a denial-of-service condition by exhausting resources on the affected appliance. The vulnerability is exploitable over the network without user interaction or privileges, but it only impacts availability. Confidentiality and integrity remain unaffected.

Critical Impact
Unauthenticated network-based denial-of-service against FortiOS appliances that serve as perimeter security devices, potentially disrupting protected network segments.

Affected Products

Fortinet FortiOS 7.6.0 through 7.6.6
Fortinet FortiOS 7.4 (all versions)
Fortinet FortiOS 7.2 (all versions)

Discovery Timeline

2026-08-12 - CVE-2026-71408 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-71408

Vulnerability Analysis

The vulnerability originates in a FortiOS component that allocates resources without enforcing usage limits or throttling. An attacker can send crafted network traffic that forces the appliance to allocate memory, sockets, or other finite resources until exhaustion. Because FortiOS acts as a network security gateway, resource exhaustion can degrade or halt firewall, VPN, and inspection services.

The issue is classified under CWE-770: Allocation of Resources Without Limits or Throttling. This weakness class typically enables denial-of-service through repeated small requests rather than a single expensive payload. Fortinet's advisory FG-IR-26-162 describes the affected components and fixed release trains.

Root Cause

The root cause is missing enforcement of upper bounds on resource consumption for a request-driven code path in FortiOS. Without quotas, rate limits, or per-client caps, an attacker can send sustained requests that consume server-side memory or connection state. Legitimate traffic then competes for exhausted resources, producing a denial-of-service effect.

Attack Vector

Exploitation requires only network reachability to the FortiOS management or service interface exposed by the vulnerable code path. No authentication or user interaction is required. The attacker sends repeated requests that each cause the device to allocate resources it never releases fast enough to keep pace with the request rate. See the Fortinet Security Advisory FG-IR-26-162 for vendor-supplied technical details.

Detection Methods for CVE-2026-71408

Indicators of Compromise

Sudden growth in FortiOS memory or session table utilization without a corresponding increase in legitimate traffic.
Repeated identical or near-identical requests from a single source or small set of sources targeting the affected service.
FortiOS logs showing resource allocation warnings, session limit exhaustion, or degraded management-plane responsiveness.

Detection Strategies

Baseline normal memory, CPU, and session counts on FortiOS appliances and alert on sustained deviations.
Inspect north-south traffic for anomalous request patterns matching the profile in Fortinet advisory FG-IR-26-162.
Correlate device health telemetry with upstream network flow data to identify amplification patterns targeting FortiOS interfaces.

Monitoring Recommendations

Ingest FortiOS syslog and SNMP metrics into a centralized analytics platform for trend analysis.
Enable alerts on FortiOS resource watermarks such as memory conserve mode, session table high-water marks, and management CPU spikes.
Track availability of firewall and VPN services with external synthetic monitoring to detect partial outages caused by resource pressure.

How to Mitigate CVE-2026-71408

Immediate Actions Required

Review Fortinet advisory FG-IR-26-162 and identify all appliances running affected FortiOS 7.6, 7.4, or 7.2 branches.
Restrict network exposure of FortiOS management and service interfaces to trusted administrative networks only.
Apply upstream rate limiting and access control lists to reduce the attack surface until patches are deployed.

Patch Information

Fortinet has published mitigation and fixed version guidance in advisory FG-IR-26-162. Administrators should upgrade FortiOS 7.6.x deployments to the fixed release identified by Fortinet and migrate FortiOS 7.4 and 7.2 systems to a supported patched branch.

Workarounds

Limit access to affected FortiOS services using trusted host configuration and local-in policies.
Deploy upstream firewall or load-balancer rate limiting for traffic destined to FortiOS interfaces.
Disable exposed services that are not required for operational use to reduce the reachable attack surface.

bash

# Configuration example: restrict FortiOS management access to trusted hosts
config system admin
  edit admin
    set trusthost1 10.0.0.0 255.255.255.0
    set trusthost2 192.168.10.0 255.255.255.0
  next
end

# Restrict inbound access to management services via local-in policy
config firewall local-in-policy
  edit 1
    set intf wan1
    set srcaddr trusted-admin-net
    set dstaddr all
    set action accept
    set service HTTPS SSH
    set schedule always
  next
end