CVE-2026-84392: Fortinet FortiOS/FortiPAM DOS Vulnerability

CVE-2026-84392 Overview

CVE-2026-84392 is a NULL Pointer Dereference vulnerability [CWE-476] affecting the httpsd daemon in multiple Fortinet products. An authenticated attacker can send crafted HTTP requests to crash the daemon, resulting in a denial-of-service condition on the management interface.

The flaw affects FortiOS, FortiPAM, and FortiProxy across multiple release branches. Fortinet published the issue in advisory FG-IR-26-173.

Critical Impact
Authenticated attackers can crash the httpsd daemon, disrupting HTTPS management services on affected Fortinet appliances until the process recovers.

Affected Products

Fortinet FortiOS 7.4 (all versions) and FortiOS 7.2 (all versions)
Fortinet FortiPAM 1.0 through 1.9.0 (all versions in each branch)
Fortinet FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 (all versions), and FortiProxy 7.2 (all versions)

Discovery Timeline

2026-09-08 - CVE-2026-84392 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84392

Vulnerability Analysis

The vulnerability resides in the httpsd daemon, which handles HTTPS management traffic on FortiOS, FortiPAM, and FortiProxy appliances. When the daemon processes specific crafted HTTP requests, it dereferences a NULL pointer and terminates.

Exploitation requires valid authentication to the management interface. The impact is limited to availability of the HTTPS service. Confidentiality and integrity are not affected, and no privilege escalation or code execution has been reported.

The attack vector is network-based but constrained by the high privilege requirement and the fact that exposed management interfaces are typically restricted to trusted administrators.

Root Cause

The root cause is a missing NULL check on a pointer used during HTTP request processing inside httpsd. When the daemon receives input that triggers an unexpected internal state, it accesses memory through a pointer that was not initialized or validated, causing a segmentation fault under CWE-476.

Attack Vector

An authenticated attacker with access to the management interface sends a crafted HTTP request to the httpsd service. The malformed request steers control flow into the vulnerable code path where the NULL dereference occurs. The httpsd process crashes, temporarily interrupting HTTPS-based administration until the daemon restarts.

See the Fortinet PSIRT Advisory FG-IR-26-173 for vendor technical details.

Detection Methods for CVE-2026-84392

Indicators of Compromise

Unexpected termination or restart events for the httpsd process on FortiOS, FortiPAM, or FortiProxy systems.
HTTPS management interface becoming briefly unreachable following administrator-authenticated HTTP traffic.
Crash logs or core dumps referencing httpsd with signal SIGSEGV.

Detection Strategies

Monitor Fortinet system logs for httpsd daemon crashes, restarts, and watchdog-triggered service recoveries.
Correlate authenticated administrative sessions with subsequent httpsd failures to identify potential abuse patterns.
Alert on repeated management-plane availability drops that coincide with authenticated API or GUI activity.

Monitoring Recommendations

Forward FortiOS, FortiPAM, and FortiProxy event logs to a centralized logging or SIEM platform for continuous review.
Track administrative account activity, including source IPs and session times, against inventory of authorized administrators.
Establish availability baselines for the HTTPS management interface and alert on deviations.

How to Mitigate CVE-2026-84392

Immediate Actions Required

Review the Fortinet PSIRT Advisory FG-IR-26-173 and apply vendor-supplied fixed versions for FortiOS, FortiPAM, and FortiProxy.
Restrict management interface access to a limited set of trusted administrator source addresses.
Audit administrative accounts and rotate credentials for any suspected compromised users.

Patch Information

Fortinet has published advisory FG-IR-26-173 covering CVE-2026-84392. Administrators should consult the advisory for the specific fixed builds corresponding to each affected FortiOS 7.4 and 7.2 branch, all FortiPAM branches from 1.0 through 1.9, and FortiProxy 7.2, 7.4, and 7.6 branches, and upgrade to the recommended releases.

Workarounds

Limit HTTPS administrative access using trusthost entries or interface-level access controls to trusted management networks only.
Enforce strong authentication, including multi-factor authentication, for all administrator accounts to reduce risk from credential misuse.
Segregate the management network from general user and internet-facing networks to reduce exposure of the httpsd service.

bash

# Example: restrict administrator access to a trusted management subnet
config system admin
    edit "admin"
        set trusthost1 10.10.20.0 255.255.255.0
    next
end