Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-71407

CVE-2026-71407HIGH

Fortinet FortiOS — A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated …

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .0042   34.2     —

AFFECTED
  Product     Versions  Fixed
  FortiOS     7.6.1 –   —
  FortiPAM    1.8.0 –   —
  FortiProxy  7.6.0 –   —

TIMELINE
  Aug 6   Reserved by fortinet
  Aug 12  Published (CNA: fortinet)
  Sep 8   RESCORED — CVE-2026-71407 (Fortinet FortiOS). CVSS 5.6 → 8.1 (NVD).

CWE-121 · CNA: fortinet · CVSS v3.1 · 1 reference · NVD status: Analyzed

Description

A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 6, 2026	Reserved	Reserved by fortinet
August 12, 2026	Published	Published (CNA: fortinet)
September 8, 2026	RESCORED	RESCORED — CVE-2026-71407 (Fortinet FortiOS). CVSS 5.6 → 8.1 (NVD).

Affected

Affected products and packages — 3 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Fortinet	FortiOS	—	7.6.1	—
Fortinet	FortiPAM	—	1.8.0	—
Fortinet	FortiProxy	—	7.6.0	—

Weaknesses

CWE-121

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-26-161 [Vendor Advisory]

Authoritative record: CVE-2026-71407 at cve.org

Vendors: fortinet

Weaknesses: CWE-121

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-71407 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.